SwiftOnSecurity / sysmon-config

Sysmon configuration file template with default high-quality event tracing
4.73k stars 1.69k forks source link

Added Consent Store to included registry paths #119

Closed svch0stz closed 3 years ago

svch0stz commented 4 years ago

By tracking the changes to the consent store keys, you can to determine when and how long a process had access to privacy protected resources. These resources include microphone, webcam, bluetooth, location, contacts and more.

Blog with testing and details: https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072