Audio Capture via SoundRecorder.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects the execution of the Windows built-in SoundRecorder.exe application when it is used with the '/FILE' command-line argument. This specific command-line argument indicates that SoundRecorder is being used to capture audio and save it to a file, which is a common technique used by attackers for audio surveillance.