T1123 Audio Capture

Technique

T1123

Tactics

Collection

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

6

Elastic, Splunk

2

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1123

MITRE description

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.(Citation: ESET Attor Oct 2019) Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT

Detection coverage

SigmaHQ community rules

• OpenCanary - SIP Request (core)
• Audio Capture (core)
• Processes Accessing the Microphone and Webcam (core)
• Audio Capture via PowerShell (core)
• Audio Capture via SoundRecorder (core)
• Suspicious Camera and Microphone Access (core)

Elastic and Splunk rules

• Linux Audio Recording Activity Detected (elastic)
• PowerShell Suspicious Script with Audio Capture Capabilities (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.