Windows Registry Changes Indicating Suspicious Camera/Microphone Capability Access
Alerts on Windows consent-store registry entries showing webcam/microphone access tied to Temp or public user paths.
- Product
- windows
- Category
- registry_event
- Author
- Den Iuzvyk (SigmaHQ), DRL 1.1
- Published
- 2020-06-07
- Updated
- 2026-07-30
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry events where the target key path includes the CapabilityAccessManager ConsentStore area for NonPackaged apps, indicating device permission entries for webcam and microphone. It also narrows to entries tied to temporary or publicly writable user locations such as Windows Temp, Recycle Bin, and Public/Desktop/Default paths. Attackers may leverage these locations to establish or modify access to camera and microphone capabilities, so correlating these consent-store changes can highlight potentially unauthorized device permission activity.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Changes Indicating Suspicious Camera/Microphone Capability Access
id: 7d4e11fc-164e-4d5e-bd98-f522699a6ee4
status: test
description: This rule flags registry events where the target key path includes the CapabilityAccessManager ConsentStore area for NonPackaged apps, indicating device permission entries for webcam and microphone. It also narrows to entries tied to temporary or publicly writable user locations such as Windows Temp, Recycle Bin, and Public/Desktop/Default paths. Attackers may leverage these locations to establish or modify access to camera and microphone capabilities, so correlating these consent-store changes can highlight potentially unauthorized device permission activity.
references:
- https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml
author: Den Iuzvyk, Huntrule Team
date: 2020-06-07
modified: 2022-10-09
tags:
- attack.collection
- attack.t1125
- attack.t1123
logsource:
category: registry_event
product: windows
detection:
selection_1:
TargetObject|contains|all:
- \Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\
- \NonPackaged
selection_2:
TargetObject|contains:
- microphone
- webcam
selection_3:
TargetObject|contains:
- :#Windows#Temp#
- :#$Recycle.bin#
- :#Temp#
- :#Users#Public#
- :#Users#Default#
- :#Users#Desktop#
condition: all of selection_*
falsepositives:
- Unlikely, there could be conferencing software running from a Temp folder accessing the devices
level: high
license: DRL-1.1
related:
- id: 62120148-6b7a-42be-8b91-271c04e281a3
type: derived