Dedicated audio-capture binary executed on Linux

Siemphony@siemphonymediumT1123unverified

Matches execution of arecord or parecord, the two ALSA/PulseAudio recorders AN0620 names, using the linux:Sysmon::EventCode=1 process-creation source the brief offers — the analytic's other two log sources cover the open and write syscalls, not execve, so they carry no process-creation observable of their own. Both binaries have essentially no purpose beyond capturing audio from a device, so the tool name alone is the signal; ffmpeg, also touched on in the wider analytic text, is left out because it is a general-purpose media tool and keying on its name would swamp the rule with ordinary transcoding and streaming activity. Sysmon for Linux is a separate agent no distribution installs by default, so a host running only stock auditd produces no events this rule can see. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0221, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (Image="*/arecord" OR Image="*/parecord")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*/arecord" OR TO_LOWER(process.executable) LIKE "*/parecord")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/arecord$|/parecord$)</field>    <description>Dedicated audio-capture binary executed on Linux</description>    <mitre>      <id>T1123</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"linux","service":"sysmon"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: sysmon / linux
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d9613b1e-a212-4eb0-9180-9721b5ceb74b

ATT&CKT1123

T1123Audio Capture

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN0620 asks for processes touching ALSA/PulseAudio devices or running capture binaries like arecord, parecord or ffmpeg, followed by file creation. This rule authors only the binary-execution slice: Image|endswith: ['/arecord', '/parecord'] against linux:Sysmon::EventCode=1 process creation. It is a single-event match with no follow-on file-creation check.

02 · Telemetry you need

Sysmon for Linux, EventID 1 — not stock auditd. Sysmon for Linux is a separate agent no distribution ships by default; a host running only vanilla auditd produces zero events here, which reads as quiet rather than blind. AN0620's other two log sources — auditd:SYSCALL::open and auditd:SYSCALL::write — cover device access and the resulting file write, but neither carries a process-creation observable, so nothing in this rule falls back to them.

03 · How the logic works

Both binaries have essentially no purpose beyond capturing audio, so a bare name match on Image is the whole rule — no CommandLine, no DevicePath, no correlation to a subsequent file write. MITRE's ExecutableName knob (AN0620) also names ffmpeg; the rule deliberately drops it, reasoning that ffmpeg's dominant use is ordinary transcoding and streaming and that keying on its name alone would swamp the rule. The reviewer flagged this as a real evasion gap rather than a settled trade-off: ffmpeg -f pulse -i default capture.wav performs the exact capture AN0620 targets and is invisible here, and ffmpeg is installed far more widely than a dedicated recorder. The rendered Splunk is a plain OR: Image="*/arecord" or Image="*/parecord".

04 · Common false positives

IVR, voicemail or accessibility-kiosk software that shells out to arecord
A user or technician running arecord -l or a short test capture to
QA/CI harnesses using parecord to capture audio output for accessibility

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0221 and never executed against logs. Coverage is Linux-only: AN0619 (Windows, microphone API access plus file writes) and AN0621 (macOS, AVFoundation/CoreAudio via Unified Logs) are separate analytics under the same DET0221 strategy and have no rule here at all.
tier_2: means adding the ffmpeg leg and confirming the arecord/parecord false positives against real telemetry;
tier_3: means correlating device access, execution and file write into one multi-event detection.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add a narrowly-scoped ffmpeg selector gated on device-input flags
MITRE's DevicePath knob (/dev/snd/*, /dev/dsp, /proc/asound/*) is
MITRE's UserContext knob — whether the caller has audio rights or is

Declared by the author

IVR, voicemail or accessibility kiosk software that legitimately shells out to arecord to capture a caller's or user's voice as part of its normal function.
A desktop user or support technician running arecord -l or a short test recording to diagnose a microphone or ALSA configuration problem.
QA or CI harnesses that use parecord to capture audio output for automated accessibility or media regression testing.

Noise checknot tested

No baseline event covers this rule’s log type (sysmon / linux), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1123, evaluated against their — events.

Share this rule

/u/siemphony/d9613b1e-a212-4eb0-9180-9721b5ceb74b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Dedicated audio-capture binary executed on Linux

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it