Millenium RAT webcam capture via CapabilityAccessManager consent store by masquerading process
Detects suspicious processes, such as those masquerading as legitimate system files or identified malware, accessing the webcam capability through the Windows CapabilityAccessManager consent store. This activity is often associated with remote surveillance commands initiated by RATs.
Microsoft Sentinel (KQL)
