<gh_stars>0
{
  "description": "An adversary can leverage a computer's peripheral devices or applications to capture audio recordings for the purpose of listening into sensitive conversations to gather information.",
  "index": [
    "apm-*-transaction*",
    "auditbeat-*",
    "endgame-*",
    "filebeat-*",
    "packetbeat-*",
    "winlogbeat-*"
  ],
  "language": "kuery",
  "name": "Audio Capture via SoundRecorder",
  "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"SoundRecorder.exe\" and process.args:\"/FILE\"",
  "risk_score": 25,
  "rule_id": "f8e06892-ed10-4452-892e-2c5a38d552f1",
  "severity": "low",
  "tags": ["Elastic"],
  "threat": [
    {
      "framework": "MITRE ATT&CK",
      "tactic": {
        "id": "TA0003",
        "name": "Collection",
        "reference": "https://attack.mitre.org/tactics/TA0009/"
      },
      "technique": [
        {
          "id": "T1123",
          "name": "Audio Capture",
          "reference": "https://attack.mitre.org/techniques/T1123/"
        }
      ]
    }
  ],
  "type": "query",
  "version": 1
}
