Skip to content

Video Capture

Technique · ATTACK:enterprise:T1125

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1125",
  "title": "Video Capture",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1125",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--6faf650d-bf31-4eb4-802d-1000cf38efaf",
  "external_id": "T1125",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:37.917Z",
  "modified": "2026-05-12T15:12:00.641Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "objective-see 2017 review",
      "url": "https://objective-see.com/blog/blog_0x25.html"
    }
  ]
}

Explicit source assertions (35)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03d08c76-d8ce-435a-bac1-9cb77cdbaa0c

Github PowerShell Empire

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07939f42-c9ce-442f-a922-6c3560ac5ddc

Trend Micro DRBControl February 2020 · Talent-Jump Clambling February 2020

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ebd7231-9228-44b6-a4d8-9131eb40bbb3

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15c3f3a3-03c9-4591-a2d2-64b5eafbd4a7

Kaspersky TajMahal April 2019

ATTACK:enterprise:S0338 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17bee216-d5ff-4e66-b221-0129be41b4f5

Zscaler Cobian Aug 2017

ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1efc9685-b2ab-46fb-91a9-a305d6c1f335

DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2043a8a7-d365-4f5c-9ee3-5b9be710f14d

jRAT Symantec Aug 2018 · Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--293f103b-ab5f-46ee-b51e-c111370f3b79

Securelist Machete Aug 2014 · Cylance Machete Mar 2017 · 360 Machete Sep 2020

ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dc986cb-ed76-42ba-9dd9-edaba07b0cc7

Cofense RevengeRAT Feb 2019 · Cylance Shaheen Nov 2018

ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30b85048-ba1f-4b43-b9bc-69c27e426039

TrendMicro DarkComet Sept 2014 · Malwarebytes DarkComet March 2018

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30be2552-9794-4eef-b3b6-fa663f68784b

Fidelis njRAT June 2013 · Citizen Lab Group5

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49efe6c7-aec6-4e54-bc7d-212816e23347

DigiTrust Agent Tesla Jan 2017 · Talos Agent Tesla Oct 2018

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c823ae9-ac1e-4f09-bb1a-5e573938fc29

CISA GRU29155 2024

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52ad9918-ffba-4897-bbdc-261504094339

Talos PoetRAT April 2020

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e60c70a-7b2f-45b8-b7d4-80e214acfb2d

SecureList Silence Nov 2017 · Group IB Silence Sept 2018

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62bf12af-cf11-48e7-8963-4fdf3e23fea0

Imminent Unit42 Dec2019 · QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S0591 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63c952f9-1fec-46db-a2f3-f87114180f25

Anomali Static Kitten February 2021

ATTACK:enterprise:S0152 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6782d7bb-5e81-4656-9445-fbd6ae1f2bdb

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79852ad8-86ff-4747-97c0-1c7faa5fa69d

Unit 42 Kazuar May 2017

ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84094d38-2a22-4d9a-b570-72e45baf17ab

AsyncRAT GitHub

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88d48848-1f23-4d91-8934-045d04b219ea

IBM TA505 April 2020 · Proofpoint TA505 October 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91926031-c1b4-462b-8597-20b10e7211ef

FireEye FIN7 Aug 2018 · DOJ FIN7 Aug 2018

ATTACK:enterprise:S1209 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4485212-aea0-4cf0-b7f1-79b3048d910f

Microsoft Storm-1811 2024 · Microsoft Quick Assist 2024

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa9b33a5-81b2-4126-b8f5-0182ec365fc8

Talos ZxShell Oct 2014

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aba4daa2-5022-4fe9-8359-7c0af1f58b86

Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c18f83e7-979e-4bd8-80bb-d0a4e8146a21

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4f9c2ad-f740-4b08-9788-c058b98f2094

EFF Manul Aug 2016

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c73f5693-e40c-48a9-b41c-8207f7180523

Fortinet Remcos Feb 2017

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfd35b85-8048-4c8f-9176-603744eecfce

FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2067a75-0d5d-4899-9d9f-6537d98296c1

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d953a664-5a8f-45a9-a3e6-819cb2cef2c7

FireEye Periscope March 2018

ATTACK:enterprise:S0644 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e31c20e8-f6f7-4ebb-89e0-51c34597c379

Talos Oblique RAT March 2021

ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5a2a20c-1ef7-49a9-a9fa-2b89231793b8

Palo Alto T9000 Feb 2016

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3c0c3c1-e7a9-46ae-94cf-e128120a7c5f

GitHub QuasarRAT · Volexity Patchwork June 2018

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd9c0570-d19a-49b6-a354-d3eaa25b00f2

Bitdefender FunnyDream Campaign November 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.