New

The executive guide to generative AI

Read more

PowerShell Suspicious Script with Audio Capture Capabilities

edit

PowerShell Suspicious Script with Audio Capture Capabilities

edit

Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling.

Rule type: query

Rule indices:

  • winlogbeat-*
  • logs-windows.*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Collection

Version: 2

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
event.category:process and
  powershell.file.script_block_text : (
    Get-MicrophoneAudio or (waveInGetNumDevs and mciSendStringA)
  )

Framework: MITRE ATT&CKTM

On this page

Was this helpful?
Feedback