Techniques › T1125 › AN0569
AN0569 Analytic 0569
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A process opens/reads /dev/video* (V4L2), performs ioctl/read loops, writes large/continuous video artifacts to disk, and/or quickly establishes outbound connections for exfiltration.</p>
- Detects
- T1125 Video Capture
- Part of
- DET0197 Behavior-chain, platform-aware detection strategy for T1125 Video Capture
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process | DC0021 OS API Execution |
| auditd:SYSCALL | PATH records referencing /dev/video* | DC0055 File Access |
| linux:osquery | select: path LIKE '/dev/video%' | DC0034 Process Metadata |
| linux:syslog | sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user | DC0064 Command Execution |
| NSM:Flow | http/file-xfer: Outbound transfer of large video-like MIME types soon after capture | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SyscallSet | Which syscalls to audit (openat, read, ioctl) – performance sensitive. |
AllowedCallers | Legitimate processes (e.g., motion, Zoom, Chrome) that access /dev/video*. |
VideoExtensions | List of file extensions to flag (.mp4/.avi/.mov/.mkv/.yuv/.h264). |
MinContinuousReadCount | Minimum read/ioctl count to infer continuous capture. |
TimeWindow | Correlate device open → file write → network exfil (e.g., 30m). |