Can you track processes accessing the camera and microphone?

  • What process was using the camera or microphone?
  • When was the last session?
  • How long was that session?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\HKEY_USERS\*\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\HKEY_USERS\*\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\

Testing RAT-like behaviour

Monitoring

<TargetObject condition="contains">SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\</TargetObject> <!-- When a process accesses bluetooth, location, webcam, microphone etc, the timestamps of last access are updated here. HKLM and HCKU -->

Conclusion

--

--

--

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Consumer perceptions of trust online — fraud survey 2021

{UPDATE} Game Show Buzzer Hack Free Resources Generator

How To Prevent Your Computer From Becoming A Botnet?

Covid-19 Common Risks and Mistakes

Security and the Cyber Arms Race

PAINT token burn notice — 4

#BRINGBACKMCCN, THORChain.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
svch0st

svch0st

More from Medium

Digital Forensics and its Types and Process by Mr. Ankur Chandrakant

Dota Malware

Cyberdefenders PacketMaze Walkthrough

Introducing Strobes VI 🎉 | Vulnerability Intelligence