T1125

Video Capture

Linux · macOS · Windowsnothing on this site yetT1125 on attack.mitre.org

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspected data theft by an insider

A resignation with unusual file access, a DLP alert, or an unexplained large transfer.

how MITRE says to see it

Behavior-chain, platform-aware detection strategy for T1125 Video Capture

A non-standard process (or script-hosted process) loads camera/video-capture libraries (e.g., avicap32.dll, mf.dll, ksproxy.ax), opens the Camera Frame Server/device, writes video/image artifacts (e.g.,.mp4/.avi/.yuv) to unusual locations, and optionally initiates outbound transfer shortly after.
A process opens/reads /dev/video* (V4L2), performs ioctl/read loops, writes large/continuous video artifacts to disk, and/or quickly establishes outbound connections for exfiltration.
A non-whitelisted process receives TCC camera entitlement (kTCCServiceCamera), opens AppleCamera/AVFoundation device handles, writes.mov/.mp4 artifacts to unusual locations, and/or beacons/exfiltrates soon after.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.