Audio Capture
- ID
- T1123
- Tactics
- TA0009 Collection
- Platforms
- Linux, macOS, Windows
- Data sources
- Process Access, File Creation, Process Creation, File Access, OS API Execution
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.[1]
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.
Detection
- DET0221 Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS
Data components: Process Access, File Creation, Process Creation, File Access, OS API Execution
Groups (2)
Software (30)
- S0021 Derusbi
- S0098 T9000
- S0115 Crimson
- S0143 Flame
- S0152 EvilGrab
- S0163 Janicab
- S0192 Pupy
- S0194 PowerSploit
- S0213 DOGCALL
- S0234 Bandook
- S0240 ROKRAT
- S0257 VERMIN
- S0260 InvisiMole
- S0282 MacSpy
- S0283 jRAT
- S0332 Remcos
- S0334 DarkComet
- S0336 NanoCore
- S0338 Cobian RAT
- S0339 Micropsia
- S0379 Revenge RAT
- S0409 Machete
- S0434 Imminent Monitor
- S0438 Attor
- S0454 Cadelspy
- S0467 TajMahal
- S1016 MacMa
- S1090 NightClub
- S1146 MgBot
- S1185 LightSpy
