Which SIEM platforms have a T1125 detection rule?

df00tech provides T1125 (Video Capture) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1125 detection?

The T1125 detection is rated high severity with medium confidence.

What are common false positives for T1125?

Common false positives for T1125 include: Legitimate video conferencing applications (Zoom, Teams, Webex, Skype) that may not be in the exclusion list if installed to non-default paths; Screen recording and productivity tools (OBS Studio, Camtasia, Loom, ShareX) used by developers or content creators; IT asset management or device inventory tools that enumerate camera hardware through registry keys.

T1125

Video Capture

Q: What data sources are required to detect Video Capture (T1125)?

Detecting Video Capture requires the following data sources: Driver: Driver Load, Process: Process Creation, File: File Creation, Windows Registry: Windows Registry Key Access, Microsoft Defender for Endpoint.

Collection Last updated: April 18, 2026

Adversaries may leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may interact with webcam devices through OS or application APIs such as the Windows Video Capture API (avicap32.dll), DirectShow, Windows Media Foundation, or platform-specific libraries on macOS and Linux. Captured video or image files may be written to disk and exfiltrated later. Threat actors including Transparent Tribe (Crimson RAT), Silence Group, and tools such as Empire, NanoCore, Agent Tesla, and PoetRAT have demonstrated active use of this technique.

What is T1125 Video Capture?

Video Capture (T1125) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.

This page provides production-ready detection logic for Video Capture, covering the data sources and telemetry it touches: Driver: Driver Load, Process: Process Creation, File: File Creation, Windows Registry: Windows Registry Key Access, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Collection
Technique: T1125 Video Capture
Canonical reference: https://attack.mitre.org/techniques/T1125/

Microsoft Sentinel / Defender

kusto

let KnownMediaApps = dynamic([
  "Teams.exe", "zoom.exe", "Skype.exe", "slack.exe", "webex.exe",
  "chrome.exe", "msedge.exe", "firefox.exe", "obs64.exe", "obs32.exe",
  "CameraApp.exe", "VideoCapture.exe", "vlc.exe", "ffmpeg.exe",
  "WindowsCamera.exe", "SnippingTool.exe", "mspaint.exe"
]);
let SuspiciousVideoPaths = dynamic([
  "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\",
  "\\ProgramData\\", "\\Users\\Public\\",
  "\\Windows\\Temp\\", "\\Temp\\"
]);
let VideoExtensions = dynamic([".avi", ".mp4", ".wmv", ".mkv", ".mov", ".flv", ".m4v"]);
// Branch 1: Suspicious DLL image load of avicap32.dll by non-media processes
let AvicapLoads = DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName =~ "avicap32.dll" or FileName =~ "vfw32.dll"
| where not(InitiatingProcessFileName has_any (KnownMediaApps))
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName, FileName,
         DetectionSource = "AvicapDLLLoad";
// Branch 2: Video file creation in suspicious paths by non-media processes
let VideoFileCreation = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName has_any (VideoExtensions)
| where FolderPath has_any (SuspiciousVideoPaths)
| where not(InitiatingProcessFileName has_any (KnownMediaApps))
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName,
         FileName = strcat(FolderPath, "\\", FileName),
         DetectionSource = "SuspiciousVideoFileCreation";
// Branch 3: Process accessing camera device objects (via registry device enumeration)
let CameraRegistryAccess = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any ("KSCATEGORY_VIDEO_CAMERA", "KSCATEGORY_CAPTURE",
                               "USB\\VID_", "Image\\Windows\\CurrentVersion\\Uninstall")
| where RegistryKey has "Camera" or RegistryKey has "Webcam" or RegistryKey has "VideoCapture"
| where not(InitiatingProcessFileName has_any (KnownMediaApps))
| where not(InitiatingProcessFileName has_any ("svchost.exe", "System", "WmiPrvSE.exe", "DeviceEnumerator.exe"))
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName,
         FileName = RegistryKey,
         DetectionSource = "CameraRegistryAccess";
union AvicapLoads, VideoFileCreation, CameraRegistryAccess
| sort by Timestamp desc

Detects webcam and video capture activity by non-media applications using three complementary approaches: (1) loading of avicap32.dll or vfw32.dll (legacy Windows Video Capture API) by processes not associated with legitimate media software; (2) creation of video files (AVI, MP4, WMV, etc.) in suspicious directories such as Temp, AppData, or ProgramData by non-media processes; (3) registry key access to camera device categories (KSCATEGORY_VIDEO_CAMERA, KSCATEGORY_CAPTURE) by unexpected processes. Known legitimate media applications (Teams, Zoom, Skype, OBS, browser processes) are excluded to reduce false positives.

high severity medium confidence

Data Sources

Driver: Driver Load Process: Process Creation File: File Creation Windows Registry: Windows Registry Key Access Microsoft Defender for Endpoint

Required Tables

DeviceImageLoadEvents DeviceFileEvents DeviceRegistryEvents

False Positives

Legitimate video conferencing applications (Zoom, Teams, Webex, Skype) that may not be in the exclusion list if installed to non-default paths
Screen recording and productivity tools (OBS Studio, Camtasia, Loom, ShareX) used by developers or content creators
IT asset management or device inventory tools that enumerate camera hardware through registry keys
Security camera management software or driver update utilities that interact with webcam device APIs
Development/testing environments where developers are building applications that interact with webcam APIs

Splunk

spl

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
(
  (EventCode=7 ImageLoaded IN ("*\\avicap32.dll", "*\\vfw32.dll", "*\\mfreadwrite.dll")
   NOT (Image IN ("*\\Teams.exe", "*\\zoom.exe", "*\\Skype.exe", "*\\slack.exe",
                   "*\\chrome.exe", "*\\msedge.exe", "*\\firefox.exe",
                   "*\\obs64.exe", "*\\obs32.exe", "*\\vlc.exe", "*\\ffmpeg.exe",
                   "*\\WindowsCamera.exe", "*\\webex.exe")))
  OR
  (EventCode=11 TargetFilename IN ("*.avi", "*.mp4", "*.wmv", "*.mkv", "*.mov", "*.m4v")
   (TargetFilename="*\\AppData\\Local\\Temp\\*" OR TargetFilename="*\\AppData\\Roaming\\*"
    OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*\\Users\\Public\\*"
    OR TargetFilename="*\\Windows\\Temp\\*")
   NOT (Image IN ("*\\Teams.exe", "*\\zoom.exe", "*\\Skype.exe", "*\\slack.exe",
                   "*\\chrome.exe", "*\\msedge.exe", "*\\firefox.exe",
                   "*\\obs64.exe", "*\\obs32.exe", "*\\vlc.exe", "*\\ffmpeg.exe",
                   "*\\WindowsCamera.exe", "*\\webex.exe")))
)
| eval DetectionType=case(
    EventCode=7, "CameraAPILoad",
    EventCode=11, "VideoFileCreation",
    true(), "Unknown"
  )
| eval SuspiciousIndicator=case(
    EventCode=7 AND match(ImageLoaded, "avicap32"), "LegacyCaptureAPI",
    EventCode=7 AND match(ImageLoaded, "vfw32"), "VideoForWindowsAPI",
    EventCode=7 AND match(ImageLoaded, "mfreadwrite"), "MediaFoundationWrite",
    EventCode=11, "VideoFileInSuspiciousPath",
    true(), "Unknown"
  )
| eval FilePath=coalesce(TargetFilename, ImageLoaded)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        FilePath, DetectionType, SuspiciousIndicator
| sort - _time

Detects video capture activity using Sysmon events: Event ID 7 (Image Load) for processes loading webcam-related DLLs (avicap32.dll, vfw32.dll for legacy Video for Windows API, mfreadwrite.dll for Windows Media Foundation write operations), and Event ID 11 (File Create) for video file creation in suspicious directories by non-media processes. Known legitimate media applications are excluded. Detection type and suspicious indicator fields help analysts quickly categorize findings.

high severity medium confidence

Data Sources

Driver: Driver Load File: File Creation Sysmon Event ID 7 Sysmon Event ID 11

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Legitimate video conferencing applications installed to non-default paths that are not covered by the exclusion list
Screen recording tools (Camtasia, Loom, ShareX, Bandicam) writing video output to AppData directories
Media SDK testing or development tools that exercise webcam APIs
Virtualization software (VMware, VirtualBox) that maps host webcam devices through media APIs
Driver installation utilities that load camera-related DLLs during device setup

Elastic Security (EQL)

eql

sequence by host.name with maxspan=5m
  [library where host.os.type == "windows" and
   dll.name in~ ("avicap32.dll", "vfw32.dll", "mfreadwrite.dll") and
   not process.name in~ ("Teams.exe", "zoom.exe", "Skype.exe", "slack.exe", "webex.exe",
                          "chrome.exe", "msedge.exe", "firefox.exe", "obs64.exe", "obs32.exe",
                          "vlc.exe", "ffmpeg.exe", "WindowsCamera.exe", "CameraApp.exe")]

any where host.os.type == "windows" and
  (
    /* Branch 1: Camera DLL load by suspicious process */
    (event.category == "library" and
     dll.name in~ ("avicap32.dll", "vfw32.dll", "mfreadwrite.dll") and
     not process.name in~ ("Teams.exe", "zoom.exe", "Skype.exe", "slack.exe", "webex.exe",
                            "chrome.exe", "msedge.exe", "firefox.exe", "obs64.exe", "obs32.exe",
                            "vlc.exe", "ffmpeg.exe", "WindowsCamera.exe", "CameraApp.exe",
                            "VideoCapture.exe", "SnippingTool.exe"))
    OR
    /* Branch 2: Video file creation in suspicious paths */
    (event.category == "file" and event.type == "creation" and
     file.extension in~ ("avi", "mp4", "wmv", "mkv", "mov", "flv", "m4v") and
     (
       file.path like~ "*\\AppData\\Local\\Temp\\*" or
       file.path like~ "*\\AppData\\Roaming\\*" or
       file.path like~ "*\\ProgramData\\*" or
       file.path like~ "*\\Users\\Public\\*" or
       file.path like~ "*\\Windows\\Temp\\*"
     ) and
     not process.name in~ ("Teams.exe", "zoom.exe", "Skype.exe", "slack.exe", "webex.exe",
                            "chrome.exe", "msedge.exe", "firefox.exe", "obs64.exe", "obs32.exe",
                            "vlc.exe", "ffmpeg.exe", "WindowsCamera.exe"))
    OR
    /* Branch 3: Camera registry enumeration by suspicious process */
    (event.category == "registry" and
     (
       registry.path like~ "*KSCATEGORY_VIDEO_CAMERA*" or
       registry.path like~ "*KSCATEGORY_CAPTURE*" or
       registry.path like~ "*Camera*" or
       registry.path like~ "*Webcam*" or
       registry.path like~ "*VideoCapture*"
     ) and
     not process.name in~ ("Teams.exe", "zoom.exe", "Skype.exe", "svchost.exe",
                            "WmiPrvSE.exe", "DeviceEnumerator.exe", "System"))
  )

Detects MITRE ATT&CK T1125 (Video Capture) by monitoring three behavioral signals: (1) suspicious processes loading Windows camera capture DLLs (avicap32.dll, vfw32.dll, mfreadwrite.dll) that are not known legitimate media applications, (2) video file creation in anomalous temp/staging paths by non-media processes, and (3) registry enumeration of camera/webcam device keys by unexpected processes. Covers RAT families such as Crimson RAT, NanoCore, Agent Tesla, and frameworks like Empire.

high severity medium confidence

Data Sources

Elastic Endpoint Security Elastic Agent with Windows integration Winlogbeat with Sysmon

Required Tables

logs-endpoint.events.library-* logs-endpoint.events.file-* logs-endpoint.events.registry-* winlogbeat-*

False Positives

Legitimate screen recording or video editing software such as Camtasia, Bandicam, or OBS loading avicap32.dll during normal operation — tune by adding known applications to the exclusion list
Enterprise video conferencing tools installed in non-standard paths or with unusual parent processes (e.g., auto-updaters) may trigger the DLL load branch
Security software or endpoint agents performing device inventory scans may enumerate camera registry keys, particularly during initial deployment or policy refresh

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip",
  "username",
  "Process Name" AS process_name,
  "Process CommandLine" AS command_line,
  "Parent Process Name" AS parent_process,
  CASE
    WHEN "filename" ILIKE '%avicap32.dll%' OR "filename" ILIKE '%vfw32.dll%' OR "filename" ILIKE '%mfreadwrite.dll%'
      THEN 'CameraAPILoad'
    WHEN "filename" ILIKE '%.avi' OR "filename" ILIKE '%.mp4' OR "filename" ILIKE '%.wmv'
      OR "filename" ILIKE '%.mkv' OR "filename" ILIKE '%.mov' OR "filename" ILIKE '%.m4v'
      THEN 'VideoFileCreation'
    WHEN "filename" ILIKE '%KSCATEGORY_VIDEO_CAMERA%' OR "filename" ILIKE '%Camera%'
      OR "filename" ILIKE '%Webcam%'
      THEN 'CameraRegistryAccess'
    ELSE 'Unknown'
  END AS detection_type,
  "filename" AS suspicious_file_or_key
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    /* Branch 1: Sysmon Event ID 7 - Image Load of camera DLLs by suspicious processes */
    (
      QIDNAME(qid) ILIKE '%image load%'
      AND (
        "filename" ILIKE '%avicap32.dll%'
        OR "filename" ILIKE '%vfw32.dll%'
        OR "filename" ILIKE '%mfreadwrite.dll%'
      )
      AND "Process Name" NOT ILIKE '%Teams.exe%'
      AND "Process Name" NOT ILIKE '%zoom.exe%'
      AND "Process Name" NOT ILIKE '%Skype.exe%'
      AND "Process Name" NOT ILIKE '%slack.exe%'
      AND "Process Name" NOT ILIKE '%webex.exe%'
      AND "Process Name" NOT ILIKE '%chrome.exe%'
      AND "Process Name" NOT ILIKE '%msedge.exe%'
      AND "Process Name" NOT ILIKE '%firefox.exe%'
      AND "Process Name" NOT ILIKE '%obs64.exe%'
      AND "Process Name" NOT ILIKE '%obs32.exe%'
      AND "Process Name" NOT ILIKE '%vlc.exe%'
      AND "Process Name" NOT ILIKE '%ffmpeg.exe%'
      AND "Process Name" NOT ILIKE '%WindowsCamera.exe%'
    )
    OR
    /* Branch 2: Sysmon Event ID 11 - Video file creation in suspicious paths */
    (
      QIDNAME(qid) ILIKE '%file create%'
      AND (
        "filename" ILIKE '%.avi'
        OR "filename" ILIKE '%.mp4'
        OR "filename" ILIKE '%.wmv'
        OR "filename" ILIKE '%.mkv'
        OR "filename" ILIKE '%.mov'
        OR "filename" ILIKE '%.m4v'
        OR "filename" ILIKE '%.flv'
      )
      AND (
        "filename" ILIKE '%\AppData\Local\Temp\%'
        OR "filename" ILIKE '%\AppData\Roaming\%'
        OR "filename" ILIKE '%\ProgramData\%'
        OR "filename" ILIKE '%\Users\Public\%'
        OR "filename" ILIKE '%\Windows\Temp\%'
      )
      AND "Process Name" NOT ILIKE '%Teams.exe%'
      AND "Process Name" NOT ILIKE '%zoom.exe%'
      AND "Process Name" NOT ILIKE '%Skype.exe%'
      AND "Process Name" NOT ILIKE '%vlc.exe%'
      AND "Process Name" NOT ILIKE '%ffmpeg.exe%'
      AND "Process Name" NOT ILIKE '%obs64.exe%'
      AND "Process Name" NOT ILIKE '%WindowsCamera.exe%'
    )
    OR
    /* Branch 3: Registry access to camera device keys */
    (
      QIDNAME(qid) ILIKE '%registry%'
      AND (
        "filename" ILIKE '%KSCATEGORY_VIDEO_CAMERA%'
        OR "filename" ILIKE '%KSCATEGORY_CAPTURE%'
        OR "filename" ILIKE '%Camera%'
        OR "filename" ILIKE '%Webcam%'
        OR "filename" ILIKE '%VideoCapture%'
      )
      AND "Process Name" NOT ILIKE '%svchost.exe%'
      AND "Process Name" NOT ILIKE '%WmiPrvSE.exe%'
      AND "Process Name" NOT ILIKE '%Teams.exe%'
      AND "Process Name" NOT ILIKE '%zoom.exe%'
    )
  )
  AND devicetime > NOW() - 86400000
ORDER BY devicetime DESC
LIMIT 500

Detects MITRE ATT&CK T1125 (Video Capture) in IBM QRadar by querying Sysmon and Windows Security log sources for three malicious behaviors: loading Windows video capture DLLs (avicap32.dll, vfw32.dll, mfreadwrite.dll) by non-media processes, creating video files in temporary/staging paths, and accessing camera-related registry keys. Correlates process context against known-legitimate media application exclusion list to reduce noise from Teams, Zoom, browser-based conferencing, and OBS.

high severity medium confidence

Data Sources

IBM QRadar SIEM Windows Sysmon (via QRadar DSM) Microsoft Windows Security Event Log (via QRadar DSM)

Required Tables

events

False Positives

Legitimate enterprise video conferencing tools installed outside their standard program paths may not match the exclusion list patterns and generate false positives on DLL load events
Automated backup or file-sync software that copies video files from user directories to staging paths (e.g., OneDrive local sync cache in Temp) will match the file creation branch
IT asset management tools such as SCCM or Tanium performing device hardware enumeration will trigger the registry camera access branch during scheduled inventory cycles

Sumo Logic CSE

sql

// T1125 - Video Capture Detection
// Branch 1: Camera capture DLL loaded by suspicious process (Sysmon EID 7)
(_sourceCategory="windows/sysmon" OR _sourceCategory="WinEventLog/Sysmon")
| parse xml auto
| where EventID = "7"
| where (
    ImageLoaded matches "*avicap32.dll" OR
    ImageLoaded matches "*vfw32.dll" OR
    ImageLoaded matches "*mfreadwrite.dll"
  )
| where !(Image matches "*Teams.exe" OR
          Image matches "*zoom.exe" OR
          Image matches "*Skype.exe" OR
          Image matches "*slack.exe" OR
          Image matches "*webex.exe" OR
          Image matches "*chrome.exe" OR
          Image matches "*msedge.exe" OR
          Image matches "*firefox.exe" OR
          Image matches "*obs64.exe" OR
          Image matches "*obs32.exe" OR
          Image matches "*vlc.exe" OR
          Image matches "*ffmpeg.exe" OR
          Image matches "*WindowsCamera.exe")
| eval DetectionType = "CameraAPILoad"
| eval SuspiciousIndicator = if(ImageLoaded matches "*avicap32*", "LegacyCaptureAPI",
    if(ImageLoaded matches "*vfw32*", "VideoForWindowsAPI",
    if(ImageLoaded matches "*mfreadwrite*", "MediaFoundationWrite", "UnknownDLL")))
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ImageLoaded, DetectionType, SuspiciousIndicator

// ---- UNION Branch 2 ----
// Run separately or use subquery union:
// (_sourceCategory="windows/sysmon")
// | parse xml auto
// | where EventID = "11"
// | where (
//     TargetFilename matches "*.avi" OR TargetFilename matches "*.mp4" OR
//     TargetFilename matches "*.wmv" OR TargetFilename matches "*.mkv" OR
//     TargetFilename matches "*.mov" OR TargetFilename matches "*.m4v" OR
//     TargetFilename matches "*.flv"
//   )
// | where (
//     TargetFilename matches "*\AppData\Local\Temp\*" OR
//     TargetFilename matches "*\AppData\Roaming\*" OR
//     TargetFilename matches "*\ProgramData\*" OR
//     TargetFilename matches "*\Users\Public\*" OR
//     TargetFilename matches "*\Windows\Temp\*"
//   )
// | where !(Image matches "*Teams.exe" OR Image matches "*zoom.exe" OR
//           Image matches "*Skype.exe" OR Image matches "*vlc.exe" OR
//           Image matches "*ffmpeg.exe" OR Image matches "*WindowsCamera.exe")
// | eval DetectionType = "VideoFileCreation"
// | eval SuspiciousIndicator = "VideoFileInSuspiciousPath"
// | fields _messageTime, Computer, User, Image, CommandLine, ParentImage, TargetFilename as SuspiciousFile, DetectionType, SuspiciousIndicator

| sort by _messageTime desc
| count by Computer, User, Image, CommandLine, DetectionType, SuspiciousIndicator

Detects MITRE ATT&CK T1125 (Video Capture) in Sumo Logic using Sysmon XML event logs. Primary query targets Sysmon Event ID 7 (Image Load) for camera capture DLL loads (avicap32.dll, vfw32.dll, mfreadwrite.dll) by processes not in the known-legitimate media application list. A commented secondary query block covers Sysmon EID 11 (File Create) for video file creation in suspicious temp/staging directories. Combine via subquery union for unified alerting. Detects tools like Crimson RAT, NanoCore, Agent Tesla, and Empire's video capture modules.

high severity medium confidence

Data Sources

Sumo Logic Cloud SIEM Windows Sysmon (via Sumo Logic Installed Collector) Windows Event Log collection

Required Tables

windows/sysmon WinEventLog/Sysmon

False Positives

Legitimate screen capture or remote desktop software (e.g., AnyDesk, TeamViewer) that loads avicap32.dll for desktop sharing functionality when not in the exclusion list will generate alerts
Video conversion or transcoding utilities (e.g., HandBrake, ffprobe) writing output to temporary directories during automated media processing pipelines
Browser plugins or Electron-based applications (Slack, Discord) loading media DLLs from non-standard installation directories not matching the exclusion path patterns

Google Chronicle / SecOps

yaral

rule t1125_video_capture_detection {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects MITRE ATT&CK T1125 - Video Capture via camera DLL loads, video file creation in suspicious paths, and camera registry enumeration by non-media processes"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1125"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1125/"
    severity = "HIGH"
    priority = "HIGH"
    version = "1.0"
    created = "2026-04-18"

  events:
    (
      /* Branch 1: Camera API DLL load by suspicious process */
      (
        $e.metadata.event_type = "PROCESS_MODULE_LOAD"
        and (
          $e.target.file.full_path = /(?i)avicap32\.dll$/ or
          $e.target.file.full_path = /(?i)vfw32\.dll$/ or
          $e.target.file.full_path = /(?i)mfreadwrite\.dll$/
        )
        and not (
          $e.principal.process.file.full_path = /(?i)(Teams|zoom|Skype|slack|webex|chrome|msedge|firefox|obs64|obs32|vlc|ffmpeg|WindowsCamera|CameraApp|VideoCapture|SnippingTool)\.exe$/
        )
      )
      or
      /* Branch 2: Video file creation in suspicious staging directories */
      (
        $e.metadata.event_type = "FILE_CREATION"
        and (
          $e.target.file.full_path = /(?i)\.(avi|mp4|wmv|mkv|mov|flv|m4v)$/
        )
        and (
          $e.target.file.full_path = /(?i)\\AppData\\Local\\Temp\\/ or
          $e.target.file.full_path = /(?i)\\AppData\\Roaming\\/ or
          $e.target.file.full_path = /(?i)\\ProgramData\\/ or
          $e.target.file.full_path = /(?i)\\Users\\Public\\/ or
          $e.target.file.full_path = /(?i)\\Windows\\Temp\\/
        )
        and not (
          $e.principal.process.file.full_path = /(?i)(Teams|zoom|Skype|slack|webex|chrome|msedge|firefox|obs64|obs32|vlc|ffmpeg|WindowsCamera)\.exe$/
        )
      )
      or
      /* Branch 3: Camera/webcam registry key access by non-system processes */
      (
        $e.metadata.event_type = "REGISTRY_OPEN_KEY"
        and (
          $e.target.registry.registry_key = /(?i)(KSCATEGORY_VIDEO_CAMERA|KSCATEGORY_CAPTURE|Camera|Webcam|VideoCapture)/
        )
        and not (
          $e.principal.process.file.full_path = /(?i)(svchost|WmiPrvSE|DeviceEnumerator|System|Teams|zoom|Skype)\.exe$/
        )
      )
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting MITRE ATT&CK T1125 (Video Capture) through three correlated behavioral signals in UDM event stream: (1) PROCESS_MODULE_LOAD events for Windows camera capture DLLs (avicap32.dll, vfw32.dll, mfreadwrite.dll) loaded by processes outside the known legitimate media application set, (2) FILE_CREATION events for video file types written to temp/staging paths by non-media processes, and (3) REGISTRY_OPEN_KEY events targeting camera device category keys by unexpected processes. Covers RAT tooling including Crimson RAT, NanoCore, Agent Tesla, PoetRAT, and post-exploitation frameworks.

high severity medium confidence

Data Sources

Google Chronicle SIEM Chronicle UDM Events Windows endpoint telemetry forwarded to Chronicle Sysmon via Chronicle forwarder

Required Tables

UDM Events (PROCESS_MODULE_LOAD, FILE_CREATION, REGISTRY_OPEN_KEY)

False Positives

Security awareness training software or endpoint DLP agents that periodically scan attached camera devices may generate REGISTRY_OPEN_KEY hits on camera category keys
Custom enterprise automation scripts or PowerShell-based IT tooling that converts desktop recordings to MP4 in the user's Temp directory as part of IT helpdesk remote session recording
Legitimate game capture or streaming software installed to non-standard paths (e.g., portable versions of OBS or Bandicam) not matching the exclusion regex patterns will trigger DLL load alerts

CrowdStrike LogScale (CQL)

cql

// T1125 - Video Capture: CrowdStrike Falcon LogScale (CQL)
// Branch 1: Camera capture DLL image load by suspicious process
#event_simpleName = ImageLoad
| ImageFileName = /(?i)(avicap32\.dll|vfw32\.dll|mfreadwrite\.dll)$/
| ImageFileName != /(?i)(Teams|zoom|Skype|slack|webex|chrome|msedge|firefox|obs64|obs32|vlc|ffmpeg|WindowsCamera|CameraApp|VideoCapture|SnippingTool)\.exe$/
| eval DetectionType = "CameraAPILoad"
| eval SuspiciousIndicator = case(
    ImageFileName = /(?i)avicap32/, "LegacyCaptureAPI",
    ImageFileName = /(?i)vfw32/, "VideoForWindowsAPI",
    ImageFileName = /(?i)mfreadwrite/, "MediaFoundationWrite",
    true(), "UnknownCameraDLL"
  )
| table([_timstamp, ComputerName, UserName, ImageFileName, ProcessImageFileName, CommandLine, ParentBaseFileName, DetectionType, SuspiciousIndicator])

// ---- Branch 2: Video file write to suspicious path (FileCreate events) ----
// #event_simpleName = /^(PeFileWrite|SuspiciousFileWrite|GeneralFileWrite)$/
// | TargetFileName = /(?i)\.(avi|mp4|wmv|mkv|mov|flv|m4v)$/
// | TargetFileName = /(?i)(\\AppData\\Local\\Temp\\|\\AppData\\Roaming\\|\\ProgramData\\|\\Users\\Public\\|\\Windows\\Temp\\)/
// | TargetFileName != /(?i)(Teams|zoom|Skype|slack|webex|chrome|msedge|firefox|obs64|obs32|vlc|ffmpeg|WindowsCamera)\.exe$/
// | eval DetectionType = "VideoFileCreation"
// | eval SuspiciousIndicator = "VideoFileInSuspiciousPath"
// | table([_timstamp, ComputerName, UserName, TargetFileName, ProcessImageFileName, CommandLine, ParentBaseFileName, DetectionType, SuspiciousIndicator])

// ---- Branch 3: Camera registry key enumeration ----
// #event_simpleName = /^(RegKeyCreate|RegKeyOpen|RegValueCreate)$/
// | RegObjectName = /(?i)(KSCATEGORY_VIDEO_CAMERA|KSCATEGORY_CAPTURE|Camera|Webcam|VideoCapture)/
// | ProcessImageFileName != /(?i)(svchost|WmiPrvSE|DeviceEnumerator|Teams|zoom|Skype)\.exe$/
// | eval DetectionType = "CameraRegistryAccess"
// | table([_timstamp, ComputerName, UserName, RegObjectName, ProcessImageFileName, CommandLine, ParentBaseFileName, DetectionType])

| groupBy([ComputerName, UserName, ProcessImageFileName, DetectionType, SuspiciousIndicator], function=count(as=EventCount))
| sort(EventCount, order=desc)

CrowdStrike Falcon LogScale (CQL) detection for MITRE ATT&CK T1125 (Video Capture) targeting three behavioral signals via Falcon sensor telemetry: (1) ImageLoad events for Windows video capture DLLs (avicap32.dll, vfw32.dll, mfreadwrite.dll) by processes outside the legitimate media application exclusion list, (2) commented branch for file write events targeting video file extensions in temp/staging directories, and (3) commented branch for registry key access to camera device enumeration keys. Primary active branch targets ImageLoad telemetry which is reliably captured by the Falcon sensor. Additional branches can be uncommented once relevant event types are confirmed in the tenant's event schema. Covers Crimson RAT, NanoCore, Agent Tesla, and Empire video capture modules.

high severity medium confidence

Data Sources

CrowdStrike Falcon EDR Falcon LogScale (Humio) Falcon sensor telemetry (ImageLoad, FileCreate, RegKeyOpen)

Required Tables

ImageLoad events PeFileWrite / GeneralFileWrite events RegKeyCreate / RegKeyOpen events

False Positives

Security testing tools or red team implants used during authorized penetration tests that load avicap32.dll as part of capability testing will generate true-positive-appearing alerts that require context from change management records to triage
Enterprise endpoint management agents (e.g., Tanium, BigFix) performing hardware capability inventory may load camera-related DLLs or access camera registry keys during scheduled compliance scans
Virtualization guest tools (e.g., VMware Tools, VirtualBox Guest Additions) that redirect physical camera devices to VMs may load video capture DLLs from unexpected process contexts during device redirection initialization

Sigma rule & cross-platform mapping

The detection logic for Video Capture (T1125) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1125 Sigma rules on detection.fyi

Platform-specific guides for T1125

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-18 Research depth: deep

References (6)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Webcam Access via avicap32.dll (Windows Legacy API)
Expected signal: Sysmon Event ID 7 (Image Load): Image=powershell.exe, ImageLoaded=C:\Windows\System32\avicap32.dll. Sysmon Event ID 1 (Process Create): CommandLine will contain 'avicap32.dll' and 'capCreateCaptureWindowA'. PowerShell Script Block Log Event ID 4104 with the full P/Invoke code.
Test 2Video File Creation in Temp Directory Simulation
Expected signal: Sysmon Event ID 11 (File Create): Image=powershell.exe, TargetFilename=C:\Users\<user>\AppData\Local\Temp\capture_<timestamp>.avi. File will contain RIFF header bytes matching AVI format. Sysmon Event ID 1 (Process Create) for the PowerShell process.
Test 3Webcam Capture via Python OpenCV (Cross-Platform)
Expected signal: Sysmon Event ID 1 (Process Create): Image=python3.exe (or python.exe), CommandLine contains 'cv2.VideoCapture' and 'imwrite'. Sysmon Event ID 7 (Image Load): opencv_videoio*.dll or _cv2.pyd loaded by python3.exe. Sysmon Event ID 11 (File Create): TargetFilename matching frame_<timestamp>.jpg in %TEMP%.
Test 4Webcam Capture Using ffmpeg (Common RAT Dependency)
Expected signal: Sysmon Event ID 1 (Process Create): Image=ffmpeg.exe, CommandLine contains '-f dshow' and '-i video=' and the output .mp4 path in %TEMP%. Sysmon Event ID 11 (File Create): TargetFilename matching *.mp4 in %TEMP% with Image=ffmpeg.exe. DeviceNetworkEvents (KQL) should be clean for this test — ffmpeg does not make network connections in offline capture mode.

Response Playbook

Triage

Identify the process that triggered the alert — check the full executable path, parent process, and whether it has a valid digital signature. Unsigned or unusually-named executables (random strings, misleading names like 'svchost32.exe') are high-priority indicators.
Determine if the process has a legitimate reason to access the webcam — is it a known application installed via the software inventory? Cross-reference with your CMDB or endpoint management platform (Intune, SCCM). If the process is not in software inventory, treat as high suspicion.
Check the parent process chain — was this process spawned by a browser, Office application, scripting engine (wscript.exe, powershell.exe), or email client? Parent processes like winword.exe or outlook.exe spawning a webcam-accessing process is a strong indicator of malware.
Review file creation artifacts — if a video file was created, check the file size (0-byte files may indicate failed capture), file creation timestamp, and whether the file was subsequently accessed by a network-capable process (potential exfiltration preparation).
Check for concurrent network activity — did the process make outbound network connections during or after webcam access? Use DeviceNetworkEvents filtered by the same process and time window. Any connection to external IPs coinciding with video file creation strongly indicates active exfiltration.
Examine the timeline — was webcam access preceded by suspicious process execution or followed by archive/compression activity (7z.exe, zip.exe)? This sequence matches the collection-then-exfiltration pattern seen in RAT families like Crimson, Agent Tesla, and NanoCore.
Check for persistence mechanisms — RATs that use webcam capabilities typically establish persistence. Review scheduled tasks, registry run keys, and services created around the same time as the alert.

Containment

If malicious access is confirmed: immediately isolate the endpoint using EDR network isolation to prevent any video data from being exfiltrated. Preserve all evidence before remediation.
Terminate the offending process and any child processes. Do not simply close the application window — use EDR kill process functionality to ensure the process tree is fully terminated.
If video files were created on disk: preserve copies to a forensic share before deletion. Calculate SHA256 hashes for evidence. Then securely delete the video files to protect the victim's privacy.
If a user account may be compromised (RAT delivered via phishing): disable the account, revoke active tokens/sessions in Azure AD/Entra ID, and notify the user through an out-of-band channel (phone call, not email which may be monitored).
Block the C2 infrastructure at the network perimeter — extract any contacted IP addresses and domains from process network logs and add to firewall blocklists and DNS sinkholes.
Disable the physical webcam via Group Policy (Device Installation Restrictions) on affected and similar endpoints as a temporary protective measure until investigation is complete.

Evidence Collection

Sysmon Event ID 7 (Image Load) logs — capture all DLL loads by the offending process, especially avicap32.dll, vfw32.dll, and Media Foundation DLLs, to establish the camera API access timeline.
Sysmon Event ID 11 (File Create) — collect all files created by the process to identify video/image outputs and any dropped payloads or configuration files.
Sysmon Event ID 3 (Network Connection) — collect all network connections from the process to identify C2 servers and data exfiltration endpoints.
Video and image files on disk — preserve with metadata intact. Use 'fsutil file queryFileFID' and forensic imaging to capture creation timestamps, last access times, and file contents. Hash all files for evidence chain.
Process memory dump — if the process is still running, capture a full process memory dump using ProcDump: 'procdump.exe -ma <PID> <output_path>'. This may contain unencrypted video frames, API keys, or C2 configuration.
Registry hives — export HKLM\SYSTEM\CurrentControlSet\Enum\USB and HKLM\SYSTEM\CurrentControlSet\Control\Class\{6bdd1fc6-810f-11d0-bec7-08002be2092f} (camera device class) to document camera device state.
Prefetch files — collect C:\Windows\Prefetch\<PROCESS_NAME>-*.pf to establish execution history and loaded DLL timestamps.
Windows Event Log — collect Microsoft-Windows-DriverFrameworks-UserMode/Operational for webcam device plug/unplug events that may correspond with malware access timing.

Escalation Criteria

! Video files created by a process with no legitimate media purpose — especially if files are created in hidden directories, named with random strings, or created outside business hours.
! Webcam API access followed by outbound network connections to non-corporate IPs — this indicates active exfiltration of captured video data.
! Process is a known RAT family — NanoCore, Agent Tesla, Crimson RAT, NjRAT, DarkComet, Cobian RAT, Revenge RAT, or PoetRAT. Immediate escalation to incident response.
! Multiple endpoints showing the same suspicious webcam access pattern within a short time window — indicates automated deployment or lateral movement of a RAT across the environment.
! Executive or privileged user endpoint affected — video capture of a CISO, CEO, or anyone with access to sensitive meetings represents a critical data exposure risk.
! Evidence of audio capture (T1123) alongside video capture — combined A/V surveillance indicates a sophisticated, targeted threat actor with persistent access.
! Any evidence that the malware has camera indicator light suppression capabilities — some advanced RATs can activate the webcam while suppressing the LED indicator.

Investigation Guide

Forensic Artifacts

> File System: Any .avi, .mp4, .wmv, or .jpg files in %TEMP%, %APPDATA%, %PROGRAMDATA%, or C:\Users\Public\ created by non-media processes — these are primary evidence of successful capture.
> File System: C:\Windows\Prefetch\<MALWARE_NAME>-*.pf — confirms execution timestamps and lists DLLs loaded including avicap32.dll.
> Registry: HKLM\SYSTEM\CurrentControlSet\Control\Class\{6bdd1fc6-810f-11d0-bec7-08002be2092f} — enumerates installed camera devices and can reveal if device was recently accessed.
> Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options — check for debugger entries targeting media apps (defense evasion).
> Event Log: Microsoft-Windows-DriverFrameworks-UserMode/Operational (Event IDs 2003, 2004, 2100, 2101) — records when USB camera devices are connected/initialized by processes.
> Event Log: Microsoft-Windows-Kernel-PnP/Operational — device plug events for USB webcams.
> Memory: Process heap of offending process may contain BITMAPINFOHEADER structures, DirectShow filter graph objects, or encoded JPEG/AVI frame data.
> Network: PCAP analysis for video-sized data transfers to external IPs. AVI/H264 streams have recognizable byte patterns (0x00000001 NAL units for H264, RIFF....AVI header for AVI).
> macOS: /var/log/system.log and unified log entries from com.apple.avfoundation for unauthorized camera access. TCC.db (~/Library/Application Support/com.apple.TCC/TCC.db) records which apps have been granted camera permission.
> Linux: /proc/<PID>/maps for loaded libraries including libv4l, libopencv, or gstreamer plugins that indicate webcam access.

Tuning Guidance

The primary challenge with T1125 detection is the broad legitimate use of webcam APIs by conferencing, streaming, and productivity software. Begin by inventorying all software in your environment that legitimately accesses webcam hardware — expand the KnownMediaApps exclusion list accordingly. Pay particular attention to non-default installation paths (some applications install to %APPDATA% rather than %ProgramFiles%), as these will not be caught by filename-only exclusions; consider expanding to include folder path patterns. For the avicap32.dll detection specifically: this is a legacy API that modern applications (Teams, Zoom, WebRTC-based tools) typically do not use — Microsoft Media Foundation and DirectShow are preferred. An alert on avicap32.dll loading by a process that is NOT an obviously legacy application warrants immediate investigation regardless of other context. For the video file creation branch: tune by adding specific exclusion patterns for your endpoint management tools and monitoring agents. If your environment uses screen recording for compliance purposes (session recording), ensure those paths are excluded. Consider adding file size thresholds — files under 5KB are likely thumbnails or test frames from initialization rather than actual surveillance footage. For high-noise environments, consider requiring two branches to fire simultaneously (e.g., DLL load AND file creation, or DLL load AND network connection) before alerting, using the hunting queries as your primary detection logic.

Hunting Queries

Hunt for any process loading legacy Windows Video Capture API DLLs (avicap32.dll, vfw32.dll) that are not associated with known media applications. A single process loading these DLLs across multiple hosts is a strong indicator of a deployed RAT with webcam functionality.

Hunting — KQL

kql

DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where FileName in~ ("avicap32.dll", "vfw32.dll", "kswdmcap.ax", "mf.dll")
| summarize LoadCount=count(),
            DeviceCount=dcount(DeviceName),
            Accounts=make_set(AccountName),
            Earliest=min(Timestamp),
            Latest=max(Timestamp)
  by InitiatingProcessFileName, InitiatingProcessFolderPath
| where not(InitiatingProcessFileName has_any ("Teams", "zoom", "Skype", "slack",
            "chrome", "msedge", "firefox", "obs", "vlc", "ffmpeg",
            "WindowsCamera", "webex", "CameraApp", "SnippingTool"))
| sort by DeviceCount desc, LoadCount desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
  ImageLoaded IN ("*\\avicap32.dll", "*\\vfw32.dll", "*\\kswdmcap.ax")
  NOT Image IN ("*\\Teams.exe","*\\zoom.exe","*\\Skype.exe","*\\slack.exe",
                "*\\chrome.exe","*\\msedge.exe","*\\firefox.exe",
                "*\\obs64.exe","*\\vlc.exe","*\\ffmpeg.exe","*\\WindowsCamera.exe")
| stats count as LoadCount, dc(host) as DeviceCount, values(host) as Hosts,
        earliest(_time) as Earliest, latest(_time) as Latest by Image, ImageLoaded
| sort - DeviceCount LoadCount

Hunt for video and image files created in staging directories (Temp, AppData, ProgramData, Public) by non-media processes. Multiple video file creations from the same process, or the same process creating files across multiple hosts, is highly indicative of automated RAT-based webcam surveillance.

Hunting — KQL

kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FileName endswith ".avi" or FileName endswith ".mp4"
    or FileName endswith ".wmv" or FileName endswith ".jpg"
    or FileName endswith ".jpeg"
| where FolderPath has_any ("\\Temp\\", "\\AppData\\", "\\ProgramData\\", "\\Public\\")
| where not(InitiatingProcessFileName has_any ("Teams", "zoom", "Skype", "slack",
            "chrome", "msedge", "firefox", "obs", "vlc", "ffmpeg",
            "WindowsCamera", "webex", "ShareX", "Snagit", "Camtasia"))
| summarize FileCount=count(),
            Files=make_set(FileName, 10),
            TotalSizeMB=sum(FileSize) / 1048576,
            DeviceCount=dcount(DeviceName)
  by InitiatingProcessFileName, InitiatingProcessFolderPath, bin(Timestamp, 1h)
| where FileCount >= 2 or TotalSizeMB > 1
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.avi" OR TargetFilename="*.mp4" OR TargetFilename="*.wmv"
   OR TargetFilename="*.jpg" OR TargetFilename="*.jpeg")
  (TargetFilename="*\\Temp\\*" OR TargetFilename="*\\AppData\\*"
   OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*\\Public\\*")
  NOT Image IN ("*\\Teams.exe","*\\zoom.exe","*\\Skype.exe","*\\slack.exe",
                "*\\chrome.exe","*\\msedge.exe","*\\firefox.exe",
                "*\\obs64.exe","*\\vlc.exe","*\\ffmpeg.exe","*\\WindowsCamera.exe")
| stats count as FileCount, values(TargetFilename) as Files,
        dc(host) as DeviceCount by Image, ParentImage
| where FileCount >= 2 OR DeviceCount > 1
| sort - DeviceCount FileCount

Correlate webcam API access with outbound public network connections within the same process and 30-minute window. This join-based hunt identifies the most dangerous scenario: a process that accessed the camera AND made outbound connections to external IPs — the hallmark of an active data exfiltration event.

Hunting — KQL

kql

let VideoCaptureProcs = DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where FileName in~ ("avicap32.dll", "vfw32.dll")
| where not(InitiatingProcessFileName has_any ("Teams", "zoom", "Skype", "obs", "vlc",
            "chrome", "msedge", "firefox", "WindowsCamera", "webex"))
| project DeviceName, InitiatingProcessId, InitiatingProcessFileName, CaptureTime=Timestamp;
VideoCaptureProcs
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteIPType == "Public"
    | project DeviceName, InitiatingProcessId, RemoteIP, RemotePort, NetworkTime=Timestamp
) on DeviceName, InitiatingProcessId
| where abs(datetime_diff('minute', NetworkTime, CaptureTime)) < 30
| project CaptureTime, NetworkTime, DeviceName, InitiatingProcessFileName,
         RemoteIP, RemotePort
| sort by CaptureTime desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval EventType=case(EventCode=7 AND match(ImageLoaded,"avicap32|vfw32"), "CameraAPILoad",
                      EventCode=3 AND NOT match(DestinationIp,"^(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|127\.)"), "PublicNetConn",
                      true(), null())
| where isnotnull(EventType)
| eval ProcKey=host."|".(coalesce(ProcessId, SourceProcessId))
| transaction ProcKey maxspan=30m
| where mvcount(EventType) > 1
  AND mvfind(EventType, "CameraAPILoad") >= 0
  AND mvfind(EventType, "PublicNetConn") >= 0
| table _time, host, Image, DestinationIp, DestinationPort, ImageLoaded
| sort - _time

Atomic Red Team Tests

Test 1 Webcam Access via avicap32.dll (Windows Legacy API)

windows

Uses PowerShell to load avicap32.dll via P/Invoke and attempt to initialize a webcam capture window using the legacy Video for Windows (VfW) API. This simulates the technique used by older RAT families (DarkComet, Cobian RAT, njRAT) that rely on the Video for Windows API for camera access. The capture window initialization will fail gracefully if no camera is present, but the DLL load event and API call are still generated for detection validation.

Command

powershell

powershell.exe -NoProfile -Command "$code = @'
using System;
using System.Runtime.InteropServices;
public class WebcamCapture {
    [DllImport(\"avicap32.dll\", CharSet=CharSet.Ansi)]
    public static extern IntPtr capCreateCaptureWindowA(string lpszWindowName, int dwStyle, int x, int y, int nWidth, int nHeight, IntPtr hwndParent, int nID);
    [DllImport(\"user32.dll\")]
    public static extern bool DestroyWindow(IntPtr hWnd);
}
'@
Add-Type -TypeDefinition $code
$hwnd = [WebcamCapture]::capCreateCaptureWindowA('TestCapture', 0x10000000, 0, 0, 320, 240, [IntPtr]::Zero, 0)
Write-Host \"Capture window handle: $hwnd\"
if ($hwnd -ne [IntPtr]::Zero) { [WebcamCapture]::DestroyWindow($hwnd) }"

Expected Telemetry

Sysmon Event ID 7 (Image Load): Image=powershell.exe, ImageLoaded=C:\Windows\System32\avicap32.dll. Sysmon Event ID 1 (Process Create): CommandLine will contain 'avicap32.dll' and 'capCreateCaptureWindowA'. PowerShell Script Block Log Event ID 4104 with the full P/Invoke code.

Expected Detection

KQL alert fires on DeviceImageLoadEvents where FileName='avicap32.dll' initiated by powershell.exe. SPL alert fires on EventCode=7 with ImageLoaded matching *avicap32.dll* from Image=*powershell.exe*. DetectionSource='AvicapDLLLoad'.

Test 2 Video File Creation in Temp Directory Simulation

windows

Simulates the file creation artifact produced by RAT-based webcam capture by creating a file with an .avi extension in the %TEMP% directory from PowerShell. This represents the output artifact created by malware that captures webcam footage and stages it in the temp directory before exfiltration, as observed in Clambling (AVI format) and similar malware families.

Command

powershell

powershell.exe -NoProfile -Command "$outputPath = Join-Path $env:TEMP 'capture_$(Get-Date -Format yyyyMMdd_HHmmss).avi'; [System.IO.File]::WriteAllBytes($outputPath, [byte[]](0x52,0x49,0x46,0x46,0x00,0x00,0x00,0x00,0x41,0x56,0x49,0x20)); Write-Host 'Simulated AVI created:' $outputPath"

Cleanup

powershell

powershell.exe -Command "Get-ChildItem $env:TEMP -Filter 'capture_*.avi' | Remove-Item -Force"

Expected Telemetry

Sysmon Event ID 11 (File Create): Image=powershell.exe, TargetFilename=C:\Users\<user>\AppData\Local\Temp\capture_<timestamp>.avi. File will contain RIFF header bytes matching AVI format. Sysmon Event ID 1 (Process Create) for the PowerShell process.

Expected Detection

KQL alert fires on DeviceFileEvents where FileName endswith '.avi' and FolderPath contains '\Temp\' with InitiatingProcessFileName='powershell.exe'. SPL alert fires on EventCode=11 with TargetFilename matching *.avi in *\Temp\* from Image=*powershell.exe*. DetectionSource='SuspiciousVideoFileCreation'.

Test 3 Webcam Capture via Python OpenCV (Cross-Platform)

windows

Uses Python with the OpenCV library to capture a single frame from the webcam and save it as a JPEG file. This technique is used by PoetRAT (which used a Python tool named Bewmac), Machete, and other Python-based RATs. The test requires Python 3 and opencv-python to be installed. If no camera is present, OpenCV will return a failed capture but still generate process and import events.

Command

powershell

python3 -c "import cv2, os, time; cap = cv2.VideoCapture(0); ret, frame = cap.read(); out_path = os.path.join(os.environ.get('TEMP', '/tmp'), 'frame_' + str(int(time.time())) + '.jpg'); cv2.imwrite(out_path, frame) if ret else open(out_path + '.failed', 'w').close(); cap.release(); print('Output:', out_path)"

Cleanup

powershell

python3 -c "import os, glob; [os.remove(f) for f in glob.glob(os.path.join(os.environ.get('TEMP', '/tmp'), 'frame_*.jpg*'))]"

Expected Telemetry

Sysmon Event ID 1 (Process Create): Image=python3.exe (or python.exe), CommandLine contains 'cv2.VideoCapture' and 'imwrite'. Sysmon Event ID 7 (Image Load): opencv_videoio*.dll or _cv2.pyd loaded by python3.exe. Sysmon Event ID 11 (File Create): TargetFilename matching frame_<timestamp>.jpg in %TEMP%.

Expected Detection

KQL: DeviceFileEvents fires on .jpg creation in Temp by python.exe. SPL: EventCode=11 with TargetFilename=*\Temp\frame_*.jpg from Image=*python*.exe. On macOS/Linux: auditd records open() syscalls to /dev/video0 or AVFoundation camera access.

Test 4 Webcam Capture Using ffmpeg (Common RAT Dependency)

windows

Uses ffmpeg to capture a 5-second video clip from the default webcam using DirectShow (Windows) and saves it to a temporary directory. ffmpeg is often bundled with or downloaded by RATs as a dependency for media capture (e.g., PoetRAT's Bewmac tool, Silence Group's surveillance implants). This tests both the process creation detection and the video file creation in a staging path.

Command

powershell

ffmpeg.exe -f dshow -i video="@device_pnp_\/\\?\usb#vid_" -t 5 -vcodec libx264 "%TEMP%\surveillance_%COMPUTERNAME%_%DATE:~-4,4%%DATE:~-7,2%%DATE:~-10,2%.mp4" -y 2>nul || echo Camera not available or ffmpeg not found

Cleanup

powershell

del /q "%TEMP%\surveillance_%COMPUTERNAME%_*.mp4" 2>nul

Expected Telemetry

Sysmon Event ID 1 (Process Create): Image=ffmpeg.exe, CommandLine contains '-f dshow' and '-i video=' and the output .mp4 path in %TEMP%. Sysmon Event ID 11 (File Create): TargetFilename matching *.mp4 in %TEMP% with Image=ffmpeg.exe. DeviceNetworkEvents (KQL) should be clean for this test — ffmpeg does not make network connections in offline capture mode.

Expected Detection

KQL: DeviceFileEvents fires on .mp4 creation in %TEMP% by ffmpeg.exe (if ffmpeg is not in KnownMediaApps allowlist). SPL: EventCode=11 with TargetFilename=*\Temp\surveillance_*.mp4. The suspicious naming convention (surveillance_ prefix, hostname and date in filename) is a high-fidelity indicator of malicious intent.

What is T1125 Video Capture?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1125

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Collection

Popular Detections

Get new detections in your inbox