{"id":"a7af2487-9c2f-42e4-9bb9-ff961f0561d5","title":"Audio Capture","description":"Detects attempts to record audio using the arecord and ecasound utilities.","author":"Pawel Mazur, Milad Cheraghi","status":"test","level":"low","date":"2021-09-04","modified":"2025-12-05","tags":["attack.collection","attack.t1123"],"technique_ids":["T1123"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Unknown"],"references":["https://linux.die.net/man/1/arecord","https://linuxconfig.org/how-to-test-microphone-with-audio-linux-sound-architecture-alsa","https://manpages.debian.org/unstable/ecasound/ecasound.1.en.html","https://ecasound.seul.org/ecasound/Documentation/examples.html#fconversions"],"source_path":"rules/linux/auditd/lnx_auditd_audio_capture.yml","source_sha256":"37d202d941715b2498efdc5499bfd08041d3499f645d40893d4b75fae4519bfd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_audio_capture.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Audio Capture\nid: a7af2487-9c2f-42e4-9bb9-ff961f0561d5\nstatus: test\ndescription: Detects attempts to record audio using the arecord and ecasound utilities.\nreferences:\n    - https://linux.die.net/man/1/arecord\n    - https://linuxconfig.org/how-to-test-microphone-with-audio-linux-sound-architecture-alsa\n    - https://manpages.debian.org/unstable/ecasound/ecasound.1.en.html\n    - https://ecasound.seul.org/ecasound/Documentation/examples.html#fconversions\nauthor: Pawel Mazur, Milad Cheraghi\ndate: 2021-09-04\nmodified: 2025-12-05\ntags:\n    - attack.collection\n    - attack.t1123\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection_execve:\n        type: EXECVE\n        a0: arecord\n        a1: '-vv'\n        a2: '-fdat'\n    selection_syscall_memfd_create:\n        type: SYSCALL\n        exe|endswith: \"/ecasound\"\n        SYSCALL: 'memfd_create'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1123","id":"T1123","name":"Audio Capture","page":"techniques/enterprise/T1123/"}],"data_path":"data/detection-rules/a7af2487-9c2f-42e4-9bb9-ff961f0561d5.json","kind":"sigma"}