Skip to content

Audio Capture

Technique · ATTACK:enterprise:T1123

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1123",
  "title": "Audio Capture",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1123",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
  "external_id": "T1123",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:34.528Z",
  "modified": "2026-05-12T15:12:00.620Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "ESET Attor Oct 2019",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"
    }
  ]
}

Explicit source assertions (32)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0143 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07d16181-ba82-42c8-a67b-8d7d5adef52d

Kaspersky Flame · Kaspersky Flame Functionality

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e8f2301-2758-43b3-8b3e-615281100eff

Securelist ScarCruft May 2019

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1148c339-09f2-4518-9562-c6aa11d5474f

EFF Manul Aug 2016

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a20e352-f318-4d15-a033-ebcc9a4c9428

FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a32c434-c3ef-42ee-a0b6-c64c589355c3

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c219416-4576-4215-80ac-1aebfadefd8b

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--404dfda0-7019-4f0e-a831-4b7c594916e8

Kaspersky TajMahal April 2019

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49f3c807-a801-4cfe-ad1c-6966bea2fc8a

ATTACK:enterprise:S0152 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5599906d-5be3-420c-9f84-e762d85c2511

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f265858-1981-43ad-bc2b-d1011996e05a

Huntress LightSpy macOS 2024

ATTACK:enterprise:S0454 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--721b7c0a-4774-4b09-882f-be7ba1cab7a5

Symantec Chafer Dec 2015

ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72e501db-419e-4fe9-9f10-fa8f266d829b

DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77171992-6bae-442a-a790-b22982a29c8d

Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7aa65075-fd72-460e-bded-8f0f5620d515

Objective-See MacMa Nov 2021

ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--842f8f4b-9d90-4533-850f-777f33ef8257

Palo Alto T9000 Feb 2016

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86e8f395-3c57-4602-8e7c-30058d05a655

Securelist Machete Aug 2014 · Cylance Machete Mar 2017 · 360 Machete Sep 2020

ATTACK:enterprise:S0163 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b5d4742-35a6-4ab7-993c-e20831ab0020

f-secure janicab · Janicab

ATTACK:enterprise:S0338 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97d2fa02-bccc-43c3-8c1d-e3667b710e5e

Zscaler Cobian Aug 2017

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fde631f-9e22-40fe-b6bb-071bd689c8f9

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ade8894f-e9fd-4391-98c3-d43ad2d7ab9c

Cofense RevengeRAT Feb 2019 · Cylance Shaheen Nov 2018

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b93d69f2-32a2-43a8-9b45-693d82a51c6b

FireEye Periscope March 2018

ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9f6e673-8c15-465e-9ef0-2bcc8efc586e

TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018

ATTACK:enterprise:S0282 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be12c965-ec79-4871-94de-c8421436c30c

objsee mac malware 2017

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c068603b-bfab-4efd-92c2-01f8d696ea88

Imminent Unit42 Dec2019 · QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S0213 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdc0bf25-e132-4214-b3e0-c784da6cfbeb

Unit 42 Nokki Oct 2018

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdd356f2-bd44-497c-b02d-30ad9ed869a2

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce85be06-0f74-480e-b55a-df92f6989902

Fortinet Remcos Feb 2017 · Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cff7d7e5-a279-4499-9b03-0cb47ac6b25c

Radware Micropsia July 2018

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d12ef54e-bf2b-4c78-acb9-69a41287f6e0

MoustachedBouncer ESET August 2023

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e66427b2-f353-446a-aedf-decccb926172

FireEye APT37 Feb 2018

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb5510f9-e2ec-4a57-9a96-93dc3028bcea

ESET Attor Oct 2019

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1123

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc622e1d-cbbe-4d8e-b184-ebd23581ec71

ESET EvasivePanda 2023 · Symantec Daggerfly 2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.