Processes Accessing Microphone and Webcam Registry Keys
This rule detects attempts by processes to access the microphone and webcam by monitoring specific registry key access events. It looks for EventIDs 4657, 4656, or 4663 associated with registry paths related to the Windows Capability Access Manager's consent store for microphone and webcam access by non-packaged applications. This can indicate an adversary attempting to collect audio or video from the endpoint.
Sigma
