Windows processes accessing microphone and webcam capability consent stores

title: Windows processes accessing microphone and webcam capability consent stores
id: a0230031-3ee2-41df-b569-4e43ad9a4ab2
status: test
description: This rule flags Windows Security events where processes are granted or interact with microphone and webcam capabilities tracked in the CapabilityAccessManager ConsentStore for NonPackaged apps. Such access is important because it enables an attacker to capture audio and video from an endpoint. The detection relies on Windows Security auditing events (4657, 4656, 4663) with object paths indicating microphone and webcam consent store activity.
references:
  - https://twitter.com/duzvik/status/1269671601852813320
  - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_camera_microphone_access.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-06-07
modified: 2021-11-27
tags:
  - attack.collection
  - attack.t1123
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4657
      - 4656
      - 4663
    ObjectName|contains:
      - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged
      - \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8cd538a4-62d5-4e83-810b-12d41e428d6e
    type: derived