---
{
  "title": "Audio Capture",
  "summary": "Audio capture records conversations or other sound available through an accessed device or application.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1123"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1123: Audio Capture",
      "url": "https://attack.mitre.org/techniques/T1123"
    }
  ],
  "editorialVersion": 2
}
---

## A microphone can become a collection source

Audio capture records sound through an accessed device or application. In a security incident, it may expose conversations, meeting content, or other information near the microphone. The risk depends on the device, permissions, application behavior, and what sound was actually available during the recording period.

Microphone access is common in legitimate conferencing, accessibility, dictation, and support tools. An alert that an application opened an audio device therefore needs context. The analyst should determine which application requested access, under which identity, for what purpose, and whether that behavior matches the user's activity.

## Investigate an unexplained recording

A fictional employee notices a microphone indicator when no meeting appears active. The responder records the observation and checks the running applications, relevant privacy permissions, recent installation history, and available endpoint telemetry.

A conferencing application may have remained active in the background. Alternatively, an unfamiliar process may be accessing audio outside an approved workflow. An indicator establishes device use under the operating system's reporting behavior; it does not alone reveal what was recorded, whether a file was created, or whether information was transmitted.

If a recording artifact is found, preserve its metadata and handle the content carefully. It may include personal or confidential conversations unrelated to the investigation. Access should be limited to the authorized purpose, with appropriate organizational guidance on sensitive material.

## Scope the collection and the uncertainty

Look for the recording interval, process identity, output location, and related transfer activity where evidence supports them. Do not assume that every sound near the device was intelligible or retained. A microphone-open event and a confirmed audio file support different levels of conclusion.

Review whether permission was granted by the user, inherited through an application setting, or changed unexpectedly. Platform controls vary, so use the relevant operating-system documentation rather than assuming every device offers the same audit detail.

## Stop unauthorized access and restore trust

Restrict the suspicious application or device as justified, preserving useful evidence first where practical. Review how the application obtained access and whether other collection capabilities were present. Simply muting a meeting application may not address a separate process with microphone access.

For practice, compare an active approved meeting, a background application left running, and an unexplained recording process. Identify which records distinguish the cases and which conclusions require examining a recording artifact. [[incident-reporting]] should separate observed microphone use from suspected information exposure. [[incident-response]] coordinates the technical work and the appropriate handling of any sensitive recording.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]