Linux Audio Capture via arecord and ecasound (auditd execve and memfd_create)
Detects Linux execution of arecord for audio capture and ecasound using memfd_create for in-memory data handling.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur, Milad Cheraghi (SigmaHQ), DRL 1.1
- Published
- 2021-09-04
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux attempts to capture audio by executing the arecord utility with specific verbose and data-format arguments, and by observing ecasound processes that perform memfd_create. Audio capture is a common collection technique used by attackers to access microphone input without user awareness. The detection relies on auditd telemetry for EXECVE events matching arecord command-line parameters and SYSCALL events where the executing ecasound binary invokes memfd_create.
Reporting behind it
- linux.die.nethttps://linux.die.net/man/1/arecord
- linuxconfig.orghttps://linuxconfig.org/how-to-test-microphone-with-audio-linux-sound-architecture-alsa
- manpages.debian.orghttps://manpages.debian.org/unstable/ecasound/ecasound.1.en.html
- ecasound.seul.orghttps://ecasound.seul.org/ecasound/Documentation/examples.html#fconversions
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_audio_capture.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Audio Capture via arecord and ecasound (auditd execve and memfd_create)
id: 5c831dac-c981-4527-8745-88a5809ca569
status: test
description: This rule flags Linux attempts to capture audio by executing the arecord utility with specific verbose and data-format arguments, and by observing ecasound processes that perform memfd_create. Audio capture is a common collection technique used by attackers to access microphone input without user awareness. The detection relies on auditd telemetry for EXECVE events matching arecord command-line parameters and SYSCALL events where the executing ecasound binary invokes memfd_create.
references:
- https://linux.die.net/man/1/arecord
- https://linuxconfig.org/how-to-test-microphone-with-audio-linux-sound-architecture-alsa
- https://manpages.debian.org/unstable/ecasound/ecasound.1.en.html
- https://ecasound.seul.org/ecasound/Documentation/examples.html#fconversions
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_audio_capture.yml
author: Pawel Mazur, Milad Cheraghi, Huntrule Team
date: 2021-09-04
modified: 2025-12-05
tags:
- attack.collection
- attack.t1123
logsource:
product: linux
service: auditd
detection:
selection_execve:
type: EXECVE
a0: arecord
a1: -vv
a2: -fdat
selection_syscall_memfd_create:
type: SYSCALL
exe|endswith: /ecasound
SYSCALL: memfd_create
condition: 1 of selection_*
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: a7af2487-9c2f-42e4-9bb9-ff961f0561d5
type: derived