Audio Capture via arecord or ecasound
Detects attempts to record audio using the `arecord` and `ecasound` utilities on Linux systems. This rule specifically looks for the execution of `arecord` with common audio recording flags (`-vv`, `-fdat`) or the `ecasound` utility making a `memfd_create` syscall, which could indicate audio processing or recording.
Sigma
