Millenium RAT microphone capture via masquerading svchost.exe
Detects modifications to the Windows microphone consent registry key (CapabilityAccessManager\ConsentStore\microphone) by processes running outside of standard Windows system directories (System32 or SysWOW64). This behavior is characteristic of unauthorized software attempting to grant itself persistence or surreptitiously gain access to audio hardware.
Microsoft Sentinel (KQL)
