Atlas RAT Webcam Access via avicap32.dll Load by Non-Media Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

This rule monitors for the loading of 'avicap32.dll' by processes that are not typically associated with video or audio conferencing and recording. 'avicap32.dll' is a legacy Windows library used for capturing video, often abused by malware to secretly access webcams for surveillance purposes. By filtering out known legitimate applications (e.g., Zoom, Teams, OBS, Skype), this rule flags potential unauthorized access to video capture capabilities.