Windows processes accessing microphone and webcam via CapabilityAccessManager ConsentStore
Identifies Windows processes interacting with non-packaged app consent entries for microphone and webcam access.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
- Published
- 2020-06-07
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security events where a process has file or object access tied to the CapabilityAccessManager ConsentStore for non-packaged microphone and webcam entries. Monitoring these paths matters because it can indicate an application requesting or using local audio/video capture permissions outside normal user workflows. It relies on Windows Security telemetry from events 4657, 4656, and 4663 and matches the targeted registry object paths containing the microphone and webcam consent store locations.
Reporting behind it
- twitter.comhttps://twitter.com/duzvik/status/1269671601852813320
- medium.comhttps://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_camera_microphone_access.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows processes accessing microphone and webcam via CapabilityAccessManager ConsentStore
id: a0230031-3ee2-41df-b569-4e43ad9a4ab2
status: test
description: This rule flags Windows Security events where a process has file or object access tied to the CapabilityAccessManager ConsentStore for non-packaged microphone and webcam entries. Monitoring these paths matters because it can indicate an application requesting or using local audio/video capture permissions outside normal user workflows. It relies on Windows Security telemetry from events 4657, 4656, and 4663 and matches the targeted registry object paths containing the microphone and webcam consent store locations.
references:
- https://twitter.com/duzvik/status/1269671601852813320
- https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_camera_microphone_access.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-06-07
modified: 2021-11-27
tags:
- attack.collection
- attack.t1123
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4657
- 4656
- 4663
ObjectName|contains:
- \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged
- \SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 8cd538a4-62d5-4e83-810b-12d41e428d6e
type: derived