Detecting and Mitigating Audio Capture (T1123)

Audio Capture (T1123) is a collection technique. MITRE lists Linux, macOS and Windows.

Meetings, calls and quiet conversations at a desk are as sensitive as any document. A compromised endpoint that can reach the microphone can listen to all of them.

How attackers use it

MITRE describes using a computer's peripheral devices, such as microphones and webcams, or applications such as voice and video call services, to capture audio recordings and listen to sensitive conversations. Malware or scripts interact with devices through an API from the operating system or an application. Audio files may be written to disk and exfiltrated later.

That last step helps defenders: a recording has to be stored and moved, which leaves file and network traces.

How to detect it

MITRE's strategy is Behavioral Detection for Audio Capture Across Windows, Linux, macOS. Analytics describe:

• Windows: unusual or unauthorized processes accessing microphone APIs such as winmm.dll and avrt.dll, followed by audio file writes to user-accessible or temp directories.
• Linux: processes accessing ALSA or PulseAudio devices, or running capture binaries such as arecord, followed by file creation or suspicious child processes.
• macOS: processes using AVFoundation or CoreAudio and accessing input devices, seen in TCC logs or unified logs, followed by writing AIFF, WAV or MP3 files.

Look for audio files appearing in odd places, long recordings from processes that are not conferencing or recording tools, and microphone use outside work hours.

How to reduce the risk

MITRE lists no formal mitigation. General practice:

1. On managed laptops, control microphone permission through device management, and review which apps hold it.
2. Use application control so unknown binaries cannot run.
3. Treat unexpected microphone indicators as a reason to investigate.

Quick check

Sources

• MITRE ATT&CK, Audio Capture (T1123)