Threat intelligence / Mitigation

Video Capture Mitigation

Mitigating this technique specifically may be difficult as it requires fine-grained API control. Efforts should be focused on preventing unwanted or unknown code from executing on a system. Identify and block potentially malicious software that may be used to capture video and images by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Mitigation

TypeMitigation

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Mitigating this technique specifically may be difficult as it requires fine-grained API control. Efforts should be focused on preventing unwanted or unknown code from executing on a system. Identify and block potentially malicious software that may be used to capture video and images by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

0 recorded

Relationships

No relationships recorded.

6 external

References

mitre-attack

T1125

Beechey 2010

http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599

Windows Commands JPCERT

https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html

NSA MS AppLocker

https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm

Corio 2008

http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx

TechNet Applocker vs SRP

https://technet.microsoft.com/en-us/library/ee791851.aspx