---
{
  "title": "Video Capture",
  "summary": "Video capture gathers visual information through cameras or communication applications.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1125"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1125: Video Capture",
      "url": "https://attack.mitre.org/techniques/T1125"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Video capture gathers visual information through cameras or communication applications. Collection may expose a person's environment as well as business activity.


## An investigation example

An unfamiliar application creates video files while the user is not participating in an approved call.

## Evidence to examine

Examine camera access, application permissions, output artifacts, process provenance, and possible uploads.

## A common analytical pitfall

A camera device being present or permitted does not establish actual recording.

## Response considerations

Preserve artifacts through privacy-conscious procedures, stop confirmed unauthorized capture, and determine the affected devices and recording period.


## Visual collection can involve cameras or applications

Video capture can gather information from cameras or communication software. It differs from a simple screenshot, although an incident can involve several visual-collection methods. The relevant capability depends on device permissions, application behavior, hardware, and the access an intruder holds. A camera being available does not prove that recording occurred.

Video meetings, accessibility features, and approved recording workflows legitimately use similar resources. Investigators should examine the requesting application, account, permission changes, recording artifacts, and any transfer activity. A process opening a camera-related interface may support a narrower claim than a completed saved recording.

## A fictional unexpected camera process

An academy receives a report that a camera indicator appeared outside a meeting. Analysts examine authorized endpoint and application records, recent software changes, and relevant permissions. They compare the event with approved communication tools and determine what evidence supports actual collection. The report should not infer private content from a device-access event alone.

Preserve relevant material under particularly careful access controls because recordings can reveal sensitive personal information. Avoid broad sharing of raw footage, and scope analysis to the authorized question. Do not activate another person's camera to reproduce the behavior. Use a prepared scenario or a device you control with explicit permission.

## Separate access, recording, and export

Create fictional events for camera permission, device access, a recording file, and an upload. Write a distinct claim for each stage and identify the missing links. Then describe the owner and approval route for legitimate meeting recordings. This connects technical evidence with responsible handling.

Response should assess both the collecting application and its access path. Removing a recording file does not revoke camera permissions or resolve a compromised account. Validate the intended settings and normal communication workflows after containment so protection and legitimate use remain coordinated.

A meeting application's recording setting may differ from operating-system camera permission. Review both boundaries where relevant, and distinguish permission to capture from permission to store or share the resulting recording.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]
- [[incident-response]]
- [[screen-capture]]