Windows Registry Changes Indicating Suspicious Camera/Microphone Capability Access

Alerts on Windows consent-store registry entries showing webcam/microphone access tied to Temp or public user paths.

FreeUnreviewedSigmahighv1

windows-registry-changes-indicating-suspicious-camera-microphone-capability-acce-62120148

title: Windows Registry Changes Indicating Suspicious Camera/Microphone Capability Access
id: 7d4e11fc-164e-4d5e-bd98-f522699a6ee4
status: test
description: This rule flags registry events where the target key path includes the CapabilityAccessManager ConsentStore area for NonPackaged apps, indicating device permission entries for webcam and microphone. It also narrows to entries tied to temporary or publicly writable user locations such as Windows Temp, Recycle Bin, and Public/Desktop/Default paths. Attackers may leverage these locations to establish or modify access to camera and microphone capabilities, so correlating these consent-store changes can highlight potentially unauthorized device permission activity.
references:
  - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml
author: Den Iuzvyk, Huntrule Team
date: 2020-06-07
modified: 2022-10-09
tags:
  - attack.collection
  - attack.t1125
  - attack.t1123
logsource:
  category: registry_event
  product: windows
detection:
  selection_1:
    TargetObject|contains|all:
      - \Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\
      - \NonPackaged
  selection_2:
    TargetObject|contains:
      - microphone
      - webcam
  selection_3:
    TargetObject|contains:
      - :#Windows#Temp#
      - :#$Recycle.bin#
      - :#Temp#
      - :#Users#Public#
      - :#Users#Default#
      - :#Users#Desktop#
  condition: all of selection_*
falsepositives:
  - Unlikely, there could be conferencing software running from a Temp folder accessing the devices
level: high
license: DRL-1.1
related:
  - id: 62120148-6b7a-42be-8b91-271c04e281a3
    type: derived

What it detects

This rule flags registry events where the target key path includes the CapabilityAccessManager ConsentStore area for NonPackaged apps, indicating device permission entries for webcam and microphone. It also narrows to entries tied to temporary or publicly writable user locations such as Windows Temp, Recycle Bin, and Public/Desktop/Default paths. Attackers may leverage these locations to establish or modify access to camera and microphone capabilities, so correlating these consent-store changes can highlight potentially unauthorized device permission activity.

Known false positives

Unlikely, there could be conferencing software running from a Temp folder accessing the devices

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.