MITRE ATT&CK T1125 Video Capture: Detecting Data Gathering

Video Capture (T1125) lets an intruder watch through a webcam or a compromised camera, gathering images of people, screens, whiteboards and physical spaces that no file-based control will ever see leave. ATT&CK v20 places T1125 in the Collection tactic (TA0009) on Windows, Linux and macOS, with no sub-techniques and no mapped M-series mitigation. ATT&CK separates it from Screen Capture (T1113): Video Capture uses camera devices or video applications, not the victim's screen, and may take still images at intervals instead of video files. This page covers the cases ATT&CK records, the platform-aware detection strategy in v20, the camera controls Windows and macOS give administrators, testing and framework mapping. For protecting executives' devices in general, see the Executive and VIP Device Protection Guide; this page stays on the technique.

Key takeaways

• Financially motivated groups use it for reconnaissance. ATT&CK records Silence filming bank employees' daily activity and FIN7 building a custom video recording capability to watch operations inside victim environments.
• Cameras are not only on laptops. ATT&CK records Ember Bear exfiltrating images from compromised IP cameras, so CCTV and IoT cameras belong in scope.
• Detection is a behaviour chain. ATT&CK v20 strategy DET0197 links an unexpected process opening the camera, video or image files written to unusual locations, and outbound transfer soon after.
• Windows has a camera pipeline log. v20 names the Windows Camera Frame Server operational log for camera sessions started by unexpected executables.
• Privacy controls carry prevention. Windows camera policies (including desktop app namespace and unsigned controls on Windows 11 24H2 and later) and macOS PPPC profiles limit which apps can open the camera.

What T1125 is

ATT&CK describes Video Capture as using peripheral devices (integrated cameras or webcams) or applications (video call services) to capture video recordings or images. Malware or scripts reach the device through an operating system or application API, and the files are usually written to disk and exfiltrated later. ATT&CK notes macOS samples such as FruitFly and Proton that record the webcam. The device paths differ by platform:

• Windows: camera and media libraries (v20 names avicap32.dll, mf.dll and ksproxy.ax) and the Camera Frame Server service that brokers camera access.
• Linux: Video4Linux (V4L2) device nodes under /dev/video*, and tools such as ffmpeg, gst-launch and v4l2-ctl.
• macOS: AVFoundation and the camera device, gated by the TCC camera service (kTCCServiceCamera).

It usually travels with Audio Capture and Screen Capture in the same surveillance module. See the MITRE ATT&CK T1123 Audio Capture and the ATT&CK Collection Tactic Guide.

How adversaries use it: real cases

All rows are ATT&CK v20 procedure examples with the source ATT&CK cites.

See the FIN7 Threat Actor Profile, the Cadet Blizzard Threat Actor Profile Guide and, for camera estates, the IP Camera and CCTV Security Guide.

What to detect and where

ATT&CK v20 detection strategy DET0197 is a behaviour chain with one analytic per platform.

Tuning notes

• Allow-list camera users: meeting clients, the built-in camera app, browsers for web meetings, identity verification and badge photo software. The Windows 11 Settings app keeps a seven-day camera usage history per app that helps build the list on sample machines.
• Score still images too: ATT&CK notes images may be captured at intervals instead of video, so periodic .jpg or .bmp creation by a non-camera process counts.
• Use file size and timing: continuous growth of a single file or regular image bursts in AppData, Temp, /tmp or ~/Library is rarely legitimate.
• Join to egress: a large upload within minutes of capture is the strongest confirmation, and ties the event to T1041 Exfiltration Over C2 Channel.
• Cover cameras on the network: for IP cameras, watch for new outbound destinations, unexpected management logins and snapshot API requests from hosts that are not your video management system.

Mitigations and preventive controls

ATT&CK v20 maps no M-series mitigation to T1125. The controls below are NHI Mgmt Group recommendations drawn from platform documentation.

As with audio, operating system prompts protect against unknown apps, not malicious code running inside an app that already holds camera permission. See the macOS TCC and Privacy Permissions Management Guide and the App Control for Business (WDAC).

Decision guidance

• Small organisations: physical shutters for executives, EDR alerts on unexpected camera access, and cameras disabled on shared devices.
• Larger organisations: deploy the Windows namespace and unsigned controls and macOS PPPC deny lists through MDM, collect the Camera Frame Server log centrally, and review camera permissions quarterly.
• Organisations with CCTV estates: treat cameras as managed assets with owners, patching and segmented networks, and include their management credentials in your privileged and machine credential inventory.

Where identity fits

Video captures what users see and hold: hardware token codes, passwords on sticky notes, screens with secrets in a terminal, and whiteboards with architecture details. IP cameras add machine identities of their own: default or shared administrator accounts, API credentials used by the video management system, and cloud connector tokens. Inventory and rotate those credentials like any other non-human identity, and remove shared accounts. See the IP Camera and CCTV Security Guide.

How to test

1. Agree scope: test in a lab or with the camera covered, with HR and legal agreement if production devices are used.
2. Emulate: run a benign script or authorised emulation module that opens the default camera, saves a few frames to a temp folder and copies them to a test server.
3. Check telemetry: confirm the module load, Camera Frame Server session, file creation and network events (Windows), /dev/video* syscalls (Linux), and TCC decisions (macOS) reach the SIEM.
4. Check the rule: the DET0197 chain should alert; the approved meeting client should not.
5. Check prevention: confirm the deny policy blocks an unapproved binary and records the decision.
6. Clean up: delete test captures and document any exception added.

Measures: endpoints with camera policy deployed, apps holding camera permission per platform, IP cameras with direct internet egress (target zero), mean time to alert in tests, and false positives per month after tuning.

Common failure patterns

• Webcam-only thinking: IP cameras and meeting room systems are left out of scope, although ATT&CK records state actors taking images from them.
• Policy that misses desktop apps: camera policies scoped to packaged apps do nothing against classic Win32 malware.
• Relying on the indicator light: users miss it, still images are brief, and it does nothing for an unattended device.
• No Mac telemetry: FruitFly, Proton and Empire all capture the webcam on macOS.
• Flat camera networks: cameras that can reach the internet directly give attackers both access and an exfiltration path.

Framework mapping

Practitioner checklist

• Allow-list processes permitted to use the camera per platform.
• Implement DET0197: camera access, video or image files in unusual paths, outbound transfer.
• Collect the Windows Camera Frame Server operational log centrally.
• Deploy LetAppsAccessCamera desktop namespace and unsigned deny controls on Windows 11 24H2 and later.
• Deploy macOS PPPC camera deny lists for apps that never need the camera.
• Fit camera shutters for executives and disable cameras on kiosks and servers.
• Segment IP cameras and remove their direct internet egress.
• Rotate IP camera and video management credentials and remove shared accounts.

Standards and references

• MITRE ATT&CK: T1125 Video Capture
• MITRE ATT&CK: Collection (TA0009)
• Microsoft Learn: Privacy Policy CSP
• Microsoft Learn: Windows privacy controls
• Apple Platform Deployment: Privacy Preferences Policy Control payload settings
• MITRE D3FEND: System Call Analysis
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: ATT&CK Collection Tactic Guide · XR and Metaverse Security Guide · Commercial Spyware Guide · macOS Detection and Response Guide · Sysmon Guide