MITRE ATT&CK / Techniques / T1123

Audio Capture

ID
T1123
Tactics
TA0009 Collection
Platforms
Linux, macOS, Windows
Data sources
Process Access, File Creation, Process Creation, File Access, OS API Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.[1]

Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.

Detection

Groups (2)

Software (30)

References

  1. ESET Attor Oct 2019