Suspicious Processes Accessing the Microphone and Webcam (via security)

title: Suspicious Processes Accessing the Microphone and Webcam (via security)
id: 00ee7bd9-0ffe-5550-ac21-8bc92ba5fd7e
status: stable
description: This rule detects potential threat actors accessing the microphone and webcam in an endpoint.
references:
    - https://attack.mitre.org/techniques/T1123/
    - https://twitter.com/duzvik/status/1269671601852813320
    - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
author: Huntrule Team
date: 2026-01-24
tags:
    - attack.collection
    - attack.t1123
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 4657
            - 4656
            - 4663
        ObjectName|contains:
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged'
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged'
    condition: selection
falsepositives:
    - Unknown
level: medium