Detect Video Capture in CrowdStrike LogScale
Adversaries may leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may interact with webcam devices through OS or application APIs such as the Windows Video Capture API (avicap32.dll), DirectShow, Windows Media Foundation, or platform-specific libraries on macOS and Linux. Captured video or image files may be written to disk and exfiltrated later. Threat actors including Transparent Tribe (Crimson RAT), Silence Group, and tools such as Empire, NanoCore, Agent Tesla, and PoetRAT have demonstrated active use of this technique.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1125 Video Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1125/
LogScale Detection Query
// T1125 - Video Capture: CrowdStrike Falcon LogScale (CQL)
// Branch 1: Camera capture DLL image load by suspicious process
#event_simpleName = ImageLoad
| ImageFileName = /(?i)(avicap32\.dll|vfw32\.dll|mfreadwrite\.dll)$/
| ImageFileName != /(?i)(Teams|zoom|Skype|slack|webex|chrome|msedge|firefox|obs64|obs32|vlc|ffmpeg|WindowsCamera|CameraApp|VideoCapture|SnippingTool)\.exe$/
| eval DetectionType = "CameraAPILoad"
| eval SuspiciousIndicator = case(
ImageFileName = /(?i)avicap32/, "LegacyCaptureAPI",
ImageFileName = /(?i)vfw32/, "VideoForWindowsAPI",
ImageFileName = /(?i)mfreadwrite/, "MediaFoundationWrite",
true(), "UnknownCameraDLL"
)
| table([_timstamp, ComputerName, UserName, ImageFileName, ProcessImageFileName, CommandLine, ParentBaseFileName, DetectionType, SuspiciousIndicator])
// ---- Branch 2: Video file write to suspicious path (FileCreate events) ----
// #event_simpleName = /^(PeFileWrite|SuspiciousFileWrite|GeneralFileWrite)$/
// | TargetFileName = /(?i)\.(avi|mp4|wmv|mkv|mov|flv|m4v)$/
// | TargetFileName = /(?i)(\\AppData\\Local\\Temp\\|\\AppData\\Roaming\\|\\ProgramData\\|\\Users\\Public\\|\\Windows\\Temp\\)/
// | TargetFileName != /(?i)(Teams|zoom|Skype|slack|webex|chrome|msedge|firefox|obs64|obs32|vlc|ffmpeg|WindowsCamera)\.exe$/
// | eval DetectionType = "VideoFileCreation"
// | eval SuspiciousIndicator = "VideoFileInSuspiciousPath"
// | table([_timstamp, ComputerName, UserName, TargetFileName, ProcessImageFileName, CommandLine, ParentBaseFileName, DetectionType, SuspiciousIndicator])
// ---- Branch 3: Camera registry key enumeration ----
// #event_simpleName = /^(RegKeyCreate|RegKeyOpen|RegValueCreate)$/
// | RegObjectName = /(?i)(KSCATEGORY_VIDEO_CAMERA|KSCATEGORY_CAPTURE|Camera|Webcam|VideoCapture)/
// | ProcessImageFileName != /(?i)(svchost|WmiPrvSE|DeviceEnumerator|Teams|zoom|Skype)\.exe$/
// | eval DetectionType = "CameraRegistryAccess"
// | table([_timstamp, ComputerName, UserName, RegObjectName, ProcessImageFileName, CommandLine, ParentBaseFileName, DetectionType])
| groupBy([ComputerName, UserName, ProcessImageFileName, DetectionType, SuspiciousIndicator], function=count(as=EventCount))
| sort(EventCount, order=desc)CrowdStrike Falcon LogScale (CQL) detection for MITRE ATT&CK T1125 (Video Capture) targeting three behavioral signals via Falcon sensor telemetry: (1) ImageLoad events for Windows video capture DLLs (avicap32.dll, vfw32.dll, mfreadwrite.dll) by processes outside the legitimate media application exclusion list, (2) commented branch for file write events targeting video file extensions in temp/staging directories, and (3) commented branch for registry key access to camera device enumeration keys. Primary active branch targets ImageLoad telemetry which is reliably captured by the Falcon sensor. Additional branches can be uncommented once relevant event types are confirmed in the tenant's event schema. Covers Crimson RAT, NanoCore, Agent Tesla, and Empire video capture modules.
Data Sources
Required Tables
False Positives & Tuning
- Security testing tools or red team implants used during authorized penetration tests that load avicap32.dll as part of capability testing will generate true-positive-appearing alerts that require context from change management records to triage
- Enterprise endpoint management agents (e.g., Tanium, BigFix) performing hardware capability inventory may load camera-related DLLs or access camera registry keys during scheduled compliance scans
- Virtualization guest tools (e.g., VMware Tools, VirtualBox Guest Additions) that redirect physical camera devices to VMs may load video capture DLLs from unexpected process contexts during device redirection initialization
Other platforms for T1125
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Webcam Access via avicap32.dll (Windows Legacy API)
Expected signal: Sysmon Event ID 7 (Image Load): Image=powershell.exe, ImageLoaded=C:\Windows\System32\avicap32.dll. Sysmon Event ID 1 (Process Create): CommandLine will contain 'avicap32.dll' and 'capCreateCaptureWindowA'. PowerShell Script Block Log Event ID 4104 with the full P/Invoke code.
- Test 2 Video File Creation in Temp Directory Simulation
Expected signal: Sysmon Event ID 11 (File Create): Image=powershell.exe, TargetFilename=C:\Users\<user>\AppData\Local\Temp\capture_<timestamp>.avi. File will contain RIFF header bytes matching AVI format. Sysmon Event ID 1 (Process Create) for the PowerShell process.
- Test 3 Webcam Capture via Python OpenCV (Cross-Platform)
Expected signal: Sysmon Event ID 1 (Process Create): Image=python3.exe (or python.exe), CommandLine contains 'cv2.VideoCapture' and 'imwrite'. Sysmon Event ID 7 (Image Load): opencv_videoio*.dll or _cv2.pyd loaded by python3.exe. Sysmon Event ID 11 (File Create): TargetFilename matching frame_<timestamp>.jpg in %TEMP%.
- Test 4 Webcam Capture Using ffmpeg (Common RAT Dependency)
Expected signal: Sysmon Event ID 1 (Process Create): Image=ffmpeg.exe, CommandLine contains '-f dshow' and '-i video=' and the output .mp4 path in %TEMP%. Sysmon Event ID 11 (File Create): TargetFilename matching *.mp4 in %TEMP% with Image=ffmpeg.exe. DeviceNetworkEvents (KQL) should be clean for this test — ffmpeg does not make network connections in offline capture mode.
References (6)
- https://attack.mitre.org/techniques/T1125/
- https://objective-see.com/blog/blog_0x25.html
- https://learn.microsoft.com/en-us/windows/win32/multimedia/video-capture
- https://learn.microsoft.com/en-us/windows/win32/medfound/microsoft-media-foundation-sdk
- https://www.group-ib.com/resources/threat-research/silence_moving_into_the_darkside.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1125/T1125.md
Response Playbook
Triage
- Identify the process that triggered the alert — check the full executable path, parent process, and whether it has a valid digital signature. Unsigned or unusually-named executables (random strings, misleading names like 'svchost32.exe') are high-priority indicators.
- Determine if the process has a legitimate reason to access the webcam — is it a known application installed via the software inventory? Cross-reference with your CMDB or endpoint management platform (Intune, SCCM). If the process is not in software inventory, treat as high suspicion.
- Check the parent process chain — was this process spawned by a browser, Office application, scripting engine (wscript.exe, powershell.exe), or email client? Parent processes like winword.exe or outlook.exe spawning a webcam-accessing process is a strong indicator of malware.
- Review file creation artifacts — if a video file was created, check the file size (0-byte files may indicate failed capture), file creation timestamp, and whether the file was subsequently accessed by a network-capable process (potential exfiltration preparation).
- Check for concurrent network activity — did the process make outbound network connections during or after webcam access? Use DeviceNetworkEvents filtered by the same process and time window. Any connection to external IPs coinciding with video file creation strongly indicates active exfiltration.
- Examine the timeline — was webcam access preceded by suspicious process execution or followed by archive/compression activity (7z.exe, zip.exe)? This sequence matches the collection-then-exfiltration pattern seen in RAT families like Crimson, Agent Tesla, and NanoCore.
- Check for persistence mechanisms — RATs that use webcam capabilities typically establish persistence. Review scheduled tasks, registry run keys, and services created around the same time as the alert.
Containment
- If malicious access is confirmed: immediately isolate the endpoint using EDR network isolation to prevent any video data from being exfiltrated. Preserve all evidence before remediation.
- Terminate the offending process and any child processes. Do not simply close the application window — use EDR kill process functionality to ensure the process tree is fully terminated.
- If video files were created on disk: preserve copies to a forensic share before deletion. Calculate SHA256 hashes for evidence. Then securely delete the video files to protect the victim's privacy.
- If a user account may be compromised (RAT delivered via phishing): disable the account, revoke active tokens/sessions in Azure AD/Entra ID, and notify the user through an out-of-band channel (phone call, not email which may be monitored).
- Block the C2 infrastructure at the network perimeter — extract any contacted IP addresses and domains from process network logs and add to firewall blocklists and DNS sinkholes.
- Disable the physical webcam via Group Policy (Device Installation Restrictions) on affected and similar endpoints as a temporary protective measure until investigation is complete.
Evidence Collection
- Sysmon Event ID 7 (Image Load) logs — capture all DLL loads by the offending process, especially avicap32.dll, vfw32.dll, and Media Foundation DLLs, to establish the camera API access timeline.
- Sysmon Event ID 11 (File Create) — collect all files created by the process to identify video/image outputs and any dropped payloads or configuration files.
- Sysmon Event ID 3 (Network Connection) — collect all network connections from the process to identify C2 servers and data exfiltration endpoints.
- Video and image files on disk — preserve with metadata intact. Use 'fsutil file queryFileFID' and forensic imaging to capture creation timestamps, last access times, and file contents. Hash all files for evidence chain.
- Process memory dump — if the process is still running, capture a full process memory dump using ProcDump: 'procdump.exe -ma <PID> <output_path>'. This may contain unencrypted video frames, API keys, or C2 configuration.
- Registry hives — export HKLM\SYSTEM\CurrentControlSet\Enum\USB and HKLM\SYSTEM\CurrentControlSet\Control\Class\{6bdd1fc6-810f-11d0-bec7-08002be2092f} (camera device class) to document camera device state.
- Prefetch files — collect C:\Windows\Prefetch\<PROCESS_NAME>-*.pf to establish execution history and loaded DLL timestamps.
- Windows Event Log — collect Microsoft-Windows-DriverFrameworks-UserMode/Operational for webcam device plug/unplug events that may correspond with malware access timing.
Escalation Criteria
- !Video files created by a process with no legitimate media purpose — especially if files are created in hidden directories, named with random strings, or created outside business hours.
- !Webcam API access followed by outbound network connections to non-corporate IPs — this indicates active exfiltration of captured video data.
- !Process is a known RAT family — NanoCore, Agent Tesla, Crimson RAT, NjRAT, DarkComet, Cobian RAT, Revenge RAT, or PoetRAT. Immediate escalation to incident response.
- !Multiple endpoints showing the same suspicious webcam access pattern within a short time window — indicates automated deployment or lateral movement of a RAT across the environment.
- !Executive or privileged user endpoint affected — video capture of a CISO, CEO, or anyone with access to sensitive meetings represents a critical data exposure risk.
- !Evidence of audio capture (T1123) alongside video capture — combined A/V surveillance indicates a sophisticated, targeted threat actor with persistent access.
- !Any evidence that the malware has camera indicator light suppression capabilities — some advanced RATs can activate the webcam while suppressing the LED indicator.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
File System: Any .avi, .mp4, .wmv, or .jpg files in %TEMP%, %APPDATA%, %PROGRAMDATA%, or C:\Users\Public\ created by non-media processes — these are primary evidence of successful capture. - >
File System: C:\Windows\Prefetch\<MALWARE_NAME>-*.pf — confirms execution timestamps and lists DLLs loaded including avicap32.dll. - >
Registry: HKLM\SYSTEM\CurrentControlSet\Control\Class\{6bdd1fc6-810f-11d0-bec7-08002be2092f} — enumerates installed camera devices and can reveal if device was recently accessed. - >
Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options — check for debugger entries targeting media apps (defense evasion). - >
Event Log: Microsoft-Windows-DriverFrameworks-UserMode/Operational (Event IDs 2003, 2004, 2100, 2101) — records when USB camera devices are connected/initialized by processes. - >
Event Log: Microsoft-Windows-Kernel-PnP/Operational — device plug events for USB webcams. - >
Memory: Process heap of offending process may contain BITMAPINFOHEADER structures, DirectShow filter graph objects, or encoded JPEG/AVI frame data. - >
Network: PCAP analysis for video-sized data transfers to external IPs. AVI/H264 streams have recognizable byte patterns (0x00000001 NAL units for H264, RIFF....AVI header for AVI). - >
macOS: /var/log/system.log and unified log entries from com.apple.avfoundation for unauthorized camera access. TCC.db (~/Library/Application Support/com.apple.TCC/TCC.db) records which apps have been granted camera permission. - >
Linux: /proc/<PID>/maps for loaded libraries including libv4l, libopencv, or gstreamer plugins that indicate webcam access.
Tuning Guidance
The primary challenge with T1125 detection is the broad legitimate use of webcam APIs by conferencing, streaming, and productivity software. Begin by inventorying all software in your environment that legitimately accesses webcam hardware — expand the KnownMediaApps exclusion list accordingly. Pay particular attention to non-default installation paths (some applications install to %APPDATA% rather than %ProgramFiles%), as these will not be caught by filename-only exclusions; consider expanding to include folder path patterns. For the avicap32.dll detection specifically: this is a legacy API that modern applications (Teams, Zoom, WebRTC-based tools) typically do not use — Microsoft Media Foundation and DirectShow are preferred. An alert on avicap32.dll loading by a process that is NOT an obviously legacy application warrants immediate investigation regardless of other context. For the video file creation branch: tune by adding specific exclusion patterns for your endpoint management tools and monitoring agents. If your environment uses screen recording for compliance purposes (session recording), ensure those paths are excluded. Consider adding file size thresholds — files under 5KB are likely thumbnails or test frames from initialization rather than actual surveillance footage. For high-noise environments, consider requiring two branches to fire simultaneously (e.g., DLL load AND file creation, or DLL load AND network connection) before alerting, using the hunting queries as your primary detection logic.
Hunting Queries
Hunt for any process loading legacy Windows Video Capture API DLLs (avicap32.dll, vfw32.dll) that are not associated with known media applications. A single process loading these DLLs across multiple hosts is a strong indicator of a deployed RAT with webcam functionality.
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where FileName in~ ("avicap32.dll", "vfw32.dll", "kswdmcap.ax", "mf.dll")
| summarize LoadCount=count(),
DeviceCount=dcount(DeviceName),
Accounts=make_set(AccountName),
Earliest=min(Timestamp),
Latest=max(Timestamp)
by InitiatingProcessFileName, InitiatingProcessFolderPath
| where not(InitiatingProcessFileName has_any ("Teams", "zoom", "Skype", "slack",
"chrome", "msedge", "firefox", "obs", "vlc", "ffmpeg",
"WindowsCamera", "webex", "CameraApp", "SnippingTool"))
| sort by DeviceCount desc, LoadCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
ImageLoaded IN ("*\\avicap32.dll", "*\\vfw32.dll", "*\\kswdmcap.ax")
NOT Image IN ("*\\Teams.exe","*\\zoom.exe","*\\Skype.exe","*\\slack.exe",
"*\\chrome.exe","*\\msedge.exe","*\\firefox.exe",
"*\\obs64.exe","*\\vlc.exe","*\\ffmpeg.exe","*\\WindowsCamera.exe")
| stats count as LoadCount, dc(host) as DeviceCount, values(host) as Hosts,
earliest(_time) as Earliest, latest(_time) as Latest by Image, ImageLoaded
| sort - DeviceCount LoadCountHunt for video and image files created in staging directories (Temp, AppData, ProgramData, Public) by non-media processes. Multiple video file creations from the same process, or the same process creating files across multiple hosts, is highly indicative of automated RAT-based webcam surveillance.
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FileName endswith ".avi" or FileName endswith ".mp4"
or FileName endswith ".wmv" or FileName endswith ".jpg"
or FileName endswith ".jpeg"
| where FolderPath has_any ("\\Temp\\", "\\AppData\\", "\\ProgramData\\", "\\Public\\")
| where not(InitiatingProcessFileName has_any ("Teams", "zoom", "Skype", "slack",
"chrome", "msedge", "firefox", "obs", "vlc", "ffmpeg",
"WindowsCamera", "webex", "ShareX", "Snagit", "Camtasia"))
| summarize FileCount=count(),
Files=make_set(FileName, 10),
TotalSizeMB=sum(FileSize) / 1048576,
DeviceCount=dcount(DeviceName)
by InitiatingProcessFileName, InitiatingProcessFolderPath, bin(Timestamp, 1h)
| where FileCount >= 2 or TotalSizeMB > 1
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.avi" OR TargetFilename="*.mp4" OR TargetFilename="*.wmv"
OR TargetFilename="*.jpg" OR TargetFilename="*.jpeg")
(TargetFilename="*\\Temp\\*" OR TargetFilename="*\\AppData\\*"
OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*\\Public\\*")
NOT Image IN ("*\\Teams.exe","*\\zoom.exe","*\\Skype.exe","*\\slack.exe",
"*\\chrome.exe","*\\msedge.exe","*\\firefox.exe",
"*\\obs64.exe","*\\vlc.exe","*\\ffmpeg.exe","*\\WindowsCamera.exe")
| stats count as FileCount, values(TargetFilename) as Files,
dc(host) as DeviceCount by Image, ParentImage
| where FileCount >= 2 OR DeviceCount > 1
| sort - DeviceCount FileCountCorrelate webcam API access with outbound public network connections within the same process and 30-minute window. This join-based hunt identifies the most dangerous scenario: a process that accessed the camera AND made outbound connections to external IPs — the hallmark of an active data exfiltration event.
let VideoCaptureProcs = DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where FileName in~ ("avicap32.dll", "vfw32.dll")
| where not(InitiatingProcessFileName has_any ("Teams", "zoom", "Skype", "obs", "vlc",
"chrome", "msedge", "firefox", "WindowsCamera", "webex"))
| project DeviceName, InitiatingProcessId, InitiatingProcessFileName, CaptureTime=Timestamp;
VideoCaptureProcs
| join kind=inner (
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| project DeviceName, InitiatingProcessId, RemoteIP, RemotePort, NetworkTime=Timestamp
) on DeviceName, InitiatingProcessId
| where abs(datetime_diff('minute', NetworkTime, CaptureTime)) < 30
| project CaptureTime, NetworkTime, DeviceName, InitiatingProcessFileName,
RemoteIP, RemotePort
| sort by CaptureTime descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval EventType=case(EventCode=7 AND match(ImageLoaded,"avicap32|vfw32"), "CameraAPILoad",
EventCode=3 AND NOT match(DestinationIp,"^(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|127\.)"), "PublicNetConn",
true(), null())
| where isnotnull(EventType)
| eval ProcKey=host."|".(coalesce(ProcessId, SourceProcessId))
| transaction ProcKey maxspan=30m
| where mvcount(EventType) > 1
AND mvfind(EventType, "CameraAPILoad") >= 0
AND mvfind(EventType, "PublicNetConn") >= 0
| table _time, host, Image, DestinationIp, DestinationPort, ImageLoaded
| sort - _timeAtomic Red Team Tests
Uses PowerShell to load avicap32.dll via P/Invoke and attempt to initialize a webcam capture window using the legacy Video for Windows (VfW) API. This simulates the technique used by older RAT families (DarkComet, Cobian RAT, njRAT) that rely on the Video for Windows API for camera access. The capture window initialization will fail gracefully if no camera is present, but the DLL load event and API call are still generated for detection validation.
Command
powershell.exe -NoProfile -Command "$code = @'
using System;
using System.Runtime.InteropServices;
public class WebcamCapture {
[DllImport(\"avicap32.dll\", CharSet=CharSet.Ansi)]
public static extern IntPtr capCreateCaptureWindowA(string lpszWindowName, int dwStyle, int x, int y, int nWidth, int nHeight, IntPtr hwndParent, int nID);
[DllImport(\"user32.dll\")]
public static extern bool DestroyWindow(IntPtr hWnd);
}
'@
Add-Type -TypeDefinition $code
$hwnd = [WebcamCapture]::capCreateCaptureWindowA('TestCapture', 0x10000000, 0, 0, 320, 240, [IntPtr]::Zero, 0)
Write-Host \"Capture window handle: $hwnd\"
if ($hwnd -ne [IntPtr]::Zero) { [WebcamCapture]::DestroyWindow($hwnd) }"Expected Telemetry
Sysmon Event ID 7 (Image Load): Image=powershell.exe, ImageLoaded=C:\Windows\System32\avicap32.dll. Sysmon Event ID 1 (Process Create): CommandLine will contain 'avicap32.dll' and 'capCreateCaptureWindowA'. PowerShell Script Block Log Event ID 4104 with the full P/Invoke code.
Expected Detection
KQL alert fires on DeviceImageLoadEvents where FileName='avicap32.dll' initiated by powershell.exe. SPL alert fires on EventCode=7 with ImageLoaded matching *avicap32.dll* from Image=*powershell.exe*. DetectionSource='AvicapDLLLoad'.
Simulates the file creation artifact produced by RAT-based webcam capture by creating a file with an .avi extension in the %TEMP% directory from PowerShell. This represents the output artifact created by malware that captures webcam footage and stages it in the temp directory before exfiltration, as observed in Clambling (AVI format) and similar malware families.
Command
powershell.exe -NoProfile -Command "$outputPath = Join-Path $env:TEMP 'capture_$(Get-Date -Format yyyyMMdd_HHmmss).avi'; [System.IO.File]::WriteAllBytes($outputPath, [byte[]](0x52,0x49,0x46,0x46,0x00,0x00,0x00,0x00,0x41,0x56,0x49,0x20)); Write-Host 'Simulated AVI created:' $outputPath"Cleanup
powershell.exe -Command "Get-ChildItem $env:TEMP -Filter 'capture_*.avi' | Remove-Item -Force"Expected Telemetry
Sysmon Event ID 11 (File Create): Image=powershell.exe, TargetFilename=C:\Users\<user>\AppData\Local\Temp\capture_<timestamp>.avi. File will contain RIFF header bytes matching AVI format. Sysmon Event ID 1 (Process Create) for the PowerShell process.
Expected Detection
KQL alert fires on DeviceFileEvents where FileName endswith '.avi' and FolderPath contains '\Temp\' with InitiatingProcessFileName='powershell.exe'. SPL alert fires on EventCode=11 with TargetFilename matching *.avi in *\Temp\* from Image=*powershell.exe*. DetectionSource='SuspiciousVideoFileCreation'.
Uses Python with the OpenCV library to capture a single frame from the webcam and save it as a JPEG file. This technique is used by PoetRAT (which used a Python tool named Bewmac), Machete, and other Python-based RATs. The test requires Python 3 and opencv-python to be installed. If no camera is present, OpenCV will return a failed capture but still generate process and import events.
Command
python3 -c "import cv2, os, time; cap = cv2.VideoCapture(0); ret, frame = cap.read(); out_path = os.path.join(os.environ.get('TEMP', '/tmp'), 'frame_' + str(int(time.time())) + '.jpg'); cv2.imwrite(out_path, frame) if ret else open(out_path + '.failed', 'w').close(); cap.release(); print('Output:', out_path)"Cleanup
python3 -c "import os, glob; [os.remove(f) for f in glob.glob(os.path.join(os.environ.get('TEMP', '/tmp'), 'frame_*.jpg*'))]"Expected Telemetry
Sysmon Event ID 1 (Process Create): Image=python3.exe (or python.exe), CommandLine contains 'cv2.VideoCapture' and 'imwrite'. Sysmon Event ID 7 (Image Load): opencv_videoio*.dll or _cv2.pyd loaded by python3.exe. Sysmon Event ID 11 (File Create): TargetFilename matching frame_<timestamp>.jpg in %TEMP%.
Expected Detection
KQL: DeviceFileEvents fires on .jpg creation in Temp by python.exe. SPL: EventCode=11 with TargetFilename=*\Temp\frame_*.jpg from Image=*python*.exe. On macOS/Linux: auditd records open() syscalls to /dev/video0 or AVFoundation camera access.
Uses ffmpeg to capture a 5-second video clip from the default webcam using DirectShow (Windows) and saves it to a temporary directory. ffmpeg is often bundled with or downloaded by RATs as a dependency for media capture (e.g., PoetRAT's Bewmac tool, Silence Group's surveillance implants). This tests both the process creation detection and the video file creation in a staging path.
Command
ffmpeg.exe -f dshow -i video="@device_pnp_\/\\?\usb#vid_" -t 5 -vcodec libx264 "%TEMP%\surveillance_%COMPUTERNAME%_%DATE:~-4,4%%DATE:~-7,2%%DATE:~-10,2%.mp4" -y 2>nul || echo Camera not available or ffmpeg not foundCleanup
del /q "%TEMP%\surveillance_%COMPUTERNAME%_*.mp4" 2>nulExpected Telemetry
Sysmon Event ID 1 (Process Create): Image=ffmpeg.exe, CommandLine contains '-f dshow' and '-i video=' and the output .mp4 path in %TEMP%. Sysmon Event ID 11 (File Create): TargetFilename matching *.mp4 in %TEMP% with Image=ffmpeg.exe. DeviceNetworkEvents (KQL) should be clean for this test — ffmpeg does not make network connections in offline capture mode.
Expected Detection
KQL: DeviceFileEvents fires on .mp4 creation in %TEMP% by ffmpeg.exe (if ffmpeg is not in KnownMediaApps allowlist). SPL: EventCode=11 with TargetFilename=*\Temp\surveillance_*.mp4. The suspicious naming convention (surveillance_ prefix, hostname and date in filename) is a high-fidelity indicator of malicious intent.