Processes accessing the camera and microphone from suspicious folder

sigma.yml

title: Processes accessing the camera and microphone from suspicious folder
description: Detects Processes accessing the camera and microphone from suspicious folder
author: Den Iuzvyk
date: 2020/06/07
reference:
- https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
tags:
- attack.collection
- attack.t1125
- attack.t1123
level: medium
logsource:
  category: sysmon
  product: windows
detection:
  selection_1:
    EventId: 13
    TargetObject|contains:
    - \Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\\*\NonPackaged
  selection_2:
    TargetObject|contains:
    - microphone
    - webcam
  selection_3:
    TargetObject|contains:
    - '#C:#Windows#Temp#'
    - '#C:#$Recycle.bin#'
    - '#C:#Temp#'
    - '#C:#Users#Public#'
    - '#C:#Users#Default#'
    - '#C:#Users#Desktop#'
  condition: all of selection_*