Suspicious Camera and Microphone Access from Unusual Locations
This rule detects suspicious access to the camera and microphone by processes running from unusual or temporary locations. It monitors registry events related to the CapabilityAccessManager ConsentStore for non-packaged applications. Specifically, it looks for modifications to registry keys that indicate access to 'microphone' or 'webcam' from paths like temporary folders, the Recycle Bin, or public user directories. This behavior can be indicative of malware attempting to record audio or video without user consent.
Sigma
