Camera capture libraries loaded outside known video applications

Siemphony@siemphonymediumT1125unverified

MITRE's Windows analytic opens with a non-standard process loading the camera and video-capture libraries before any video artefact reaches disk, and module load is the only one of the listed log sources that names both the loading process and the library in a single event. The selection matches the capture-specific modules MITRE cites — the Video for Windows capture shim, the kernel-streaming DirectShow proxy and the Media Foundation capture engine — while the exclusion is MITRE's AllowedProcesses knob made concrete with the conferencing, browser and streaming binaries that legitimately open a webcam. MITRE's generic mf.dll is deliberately not matched: Media Foundation core loads for any media playback and would drown the signal. The file-write and egress steps of the chain are a timed correlation that Sigma cannot express, so this rule is the device-access precursor only. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0197, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceImageLoadEvents| where ((FolderPath endswith "\\avicap32.dll" or FolderPath endswith "\\ksproxy.ax" or FolderPath endswith "\\mfcaptureengine.dll") and not ((InitiatingProcessFolderPath endswith "\\Teams.exe" or InitiatingProcessFolderPath endswith "\\ms-teams.exe" or InitiatingProcessFolderPath endswith "\\Zoom.exe" or InitiatingProcessFolderPath endswith "\\CptHost.exe" or InitiatingProcessFolderPath endswith "\\Webex.exe" or InitiatingProcessFolderPath endswith "\\slack.exe" or InitiatingProcessFolderPath endswith "\\obs64.exe" or InitiatingProcessFolderPath endswith "\\obs32.exe" or InitiatingProcessFolderPath endswith "\\WindowsCamera.exe" or InitiatingProcessFolderPath endswith "\\chrome.exe" or InitiatingProcessFolderPath endswith "\\msedge.exe" or InitiatingProcessFolderPath endswith "\\firefox.exe")))

Splunk · SPL

Run this as a search.

index=* ((ImageLoaded="*\\avicap32.dll" OR ImageLoaded="*\\ksproxy.ax" OR ImageLoaded="*\\mfcaptureengine.dll") AND NOT ((Image="*\\Teams.exe" OR Image="*\\ms-teams.exe" OR Image="*\\Zoom.exe" OR Image="*\\CptHost.exe" OR Image="*\\Webex.exe" OR Image="*\\slack.exe" OR Image="*\\obs64.exe" OR Image="*\\obs32.exe" OR Image="*\\WindowsCamera.exe" OR Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*\\\\avicap32.dll" OR TO_LOWER(file.path) LIKE "*\\\\ksproxy.ax" OR TO_LOWER(file.path) LIKE "*\\\\mfcaptureengine.dll") AND NOT ((TO_LOWER(process.executable) LIKE "*\\\\teams.exe" OR TO_LOWER(process.executable) LIKE "*\\\\ms-teams.exe" OR TO_LOWER(process.executable) LIKE "*\\\\zoom.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cpthost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\webex.exe" OR TO_LOWER(process.executable) LIKE "*\\\\slack.exe" OR TO_LOWER(process.executable) LIKE "*\\\\obs64.exe" OR TO_LOWER(process.executable) LIKE "*\\\\obs32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windowscamera.exe" OR TO_LOWER(process.executable) LIKE "*\\\\chrome.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msedge.exe" OR TO_LOWER(process.executable) LIKE "*\\\\firefox.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,image_load,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ImageLoaded" type="pcre2">(?i)(\\avicap32\.dll$|\\ksproxy\.ax$|\\mfcaptureengine\.dll$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\Teams\.exe$|\\ms-teams\.exe$|\\Zoom\.exe$|\\CptHost\.exe$|\\Webex\.exe$|\\slack\.exe$|\\obs64\.exe$|\\obs32\.exe$|\\WindowsCamera\.exe$|\\chrome\.exe$|\\msedge\.exe$|\\firefox\.exe$)</field>    <description>Camera capture libraries loaded outside known video applications</description>    <mitre>      <id>T1125</id>    </mitre>  </rule></group>

At a glance

Logsource: image_load / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 7ebd0421-d6b8-4961-9496-b3d4f8bb60c7

ATT&CKT1125

T1125Video Capture

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

Windows does not log "the webcam turned on". What it can log is which DLL a process pulled into its address space. So this rule — Camera capture libraries loaded outside known video applications — takes the first link of MITRE's five-step chain and nothing else: three capture modules by name, minus twelve process names expected to hold a camera open. The rest of AN0568 — the .mp4 write to an unusual path, the transfer minutes later — is a join across file_event and network_connection inside a time window, which Sigma has no construct for. The rule stops at device access and says so.

02 · Telemetry you need

Sysmon EventID 7, rendered as category: image_load / product: windows, copied verbatim from AN0568's Module Load source. Module load is off in a stock Sysmon config; if nobody enabled it this returns zero rows, and zero rows reads as quiet rather than blind. Sentinel refuses the logsource entirely — no table is modelled — so only three backends render.
Two of AN0568's six knobs have no field here. EventID 7 carries no parent process, so MITRE's ParentProcessAllowList knob is unreachable, and MinFileSizeMB belongs to a file event. Noticing that a knob has nowhere to land is part of reading a brief.

03 · How the logic works

selection is one field, ImageLoaded|endswith, with \avicap32.dll (the Video for Windows capture shim), \ksproxy.ax (the kernel-streaming DirectShow proxy) and \mfcaptureengine.dll (the Media Foundation capture engine). endswith with a leading backslash rather than a full path is deliberate: these load from System32, SysWOW64 and side-by-side directories, and the backslash anchors the match at a filename boundary so fakeavicap32.dll cannot slip in. AN0568 names avicap32.dll, mf.dll and ksproxy.ax. Substituting mfcaptureengine.dll for mf.dll is an authoring choice, not MITRE's list — mf.dll loads for any media playback and would drown the signal. The reviewer accepted the reasoning and asked that the substitution stay visible. filter_video_apps is MITRE's AllowedProcesses knob (MITRE offers Teams, Zoom and OBS as examples) populated here with twelve binaries including \ms-teams.exe, \CptHost.exe, \obs64.exe, \WindowsCamera.exe and three browsers. condition: selection and not filter_video_apps negates a single-field OR group — the shape Wazuh renders; negating an AND group is what it refuses.

04 · Common false positives

The exclusion list filters the wrong process. On Windows 10/11 the Camera Frame Server, hosted in svchost.exe (service FrameServer, with FrameServerMonitor), performs the actual device open for every WinRT MediaCapture consumer. Teams and Windows Camera never load ksproxy.ax themselves. svchost.exe is not in the filter, so the expected outcome on a modern estate is that every legitimate camera session produces a hit from svchost while the excluded binary produces none. That is the dominant volume, not a corner case.
Behind it: OEM webcam utilities and chipset installers enumerating capture devices during deployment; endpoint agents inventorying peripherals on a schedule; barcode scanners, document cameras and virtual cameras, which are capture devices as far as these libraries are concerned.

05 · Detection maturity

tier_1: . Authored from MITRE's scaffold — which ships prose, log sources and knobs, no query logic — and never executed against a log line. The frame-server finding is a concrete reason to expect its current shape to be wrong in production.
tier_2: enable EventID 7 for these modules, run read-only for a fortnight, and see whether the hits are svchost or something else.
tier_3: ** rebuild the exclusion around the observed broker model, then correlate device access with a file_event rule for MITRE's VideoExtensions inside a TimeWindow, so the alert means a capture that produced a file.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Handle svchost.exe/FrameServerMonitor.exe first, or pivot the exclusion
Image|endswith: '\chrome.exe' is an unanchored filename match with no
VideoExtensions, RarePathRegex and TimeWindow belong to a companion

Declared by the author

Conferencing and streaming software not covered by the exclusion list — every estate runs a different set, and MITRE exposes AllowedProcesses for exactly this reason. Extend the filter with the camera consumers your image actually ships rather than lowering the level.
Camera and chipset driver installers, OEM webcam utilities and firmware updaters, which enumerate capture devices once during a deployment window and load the same DirectShow and Media Foundation modules while doing so.
Device-management and endpoint agents that inventory attached peripherals on a schedule. MITRE's ParentProcessAllowList knob is aimed at these brokers, but module load events carry no parent, so they can only be filtered on Image here.
Barcode scanners, document cameras and virtual-camera drivers used by kiosk or point-of-sale applications, which are capture devices as far as these libraries are concerned.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1125, evaluated against their image_load events.

Share this rule

/u/siemphony/7ebd0421-d6b8-4961-9496-b3d4f8bb60c7

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Camera capture libraries loaded outside known video applications

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it