Detect Video Capture in Google Chronicle

rule t1125_video_capture_detection {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects MITRE ATT&CK T1125 - Video Capture via camera DLL loads, video file creation in suspicious paths, and camera registry enumeration by non-media processes"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1125"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1125/"
    severity = "HIGH"
    priority = "HIGH"
    version = "1.0"
    created = "2026-04-18"

  events:
    (
      /* Branch 1: Camera API DLL load by suspicious process */
      (
        $e.metadata.event_type = "PROCESS_MODULE_LOAD"
        and (
          $e.target.file.full_path = /(?i)avicap32\.dll$/ or
          $e.target.file.full_path = /(?i)vfw32\.dll$/ or
          $e.target.file.full_path = /(?i)mfreadwrite\.dll$/
        )
        and not (
          $e.principal.process.file.full_path = /(?i)(Teams|zoom|Skype|slack|webex|chrome|msedge|firefox|obs64|obs32|vlc|ffmpeg|WindowsCamera|CameraApp|VideoCapture|SnippingTool)\.exe$/
        )
      )
      or
      /* Branch 2: Video file creation in suspicious staging directories */
      (
        $e.metadata.event_type = "FILE_CREATION"
        and (
          $e.target.file.full_path = /(?i)\.(avi|mp4|wmv|mkv|mov|flv|m4v)$/
        )
        and (
          $e.target.file.full_path = /(?i)\\AppData\\Local\\Temp\\/ or
          $e.target.file.full_path = /(?i)\\AppData\\Roaming\\/ or
          $e.target.file.full_path = /(?i)\\ProgramData\\/ or
          $e.target.file.full_path = /(?i)\\Users\\Public\\/ or
          $e.target.file.full_path = /(?i)\\Windows\\Temp\\/
        )
        and not (
          $e.principal.process.file.full_path = /(?i)(Teams|zoom|Skype|slack|webex|chrome|msedge|firefox|obs64|obs32|vlc|ffmpeg|WindowsCamera)\.exe$/
        )
      )
      or
      /* Branch 3: Camera/webcam registry key access by non-system processes */
      (
        $e.metadata.event_type = "REGISTRY_OPEN_KEY"
        and (
          $e.target.registry.registry_key = /(?i)(KSCATEGORY_VIDEO_CAMERA|KSCATEGORY_CAPTURE|Camera|Webcam|VideoCapture)/
        )
        and not (
          $e.principal.process.file.full_path = /(?i)(svchost|WmiPrvSE|DeviceEnumerator|System|Teams|zoom|Skype)\.exe$/
        )
      )
    )

  condition:
    $e
}