Vidgrab

Hunt Hypothesis

This detection rule identifies potential unauthorized screen capture or video recording activities that may indicate an adversary exfiltrating sensitive visual data from user workstations. Proactively hunting for these events in Azure Sentinel is critical to uncover stealthy reconnaissance efforts where attackers leverage legitimate tools to bypass traditional file-based monitoring and extract real-time information.

YARA Rule

rule Vidgrab : Family
{
    meta:
        description = "Vidgrab"
        author = "Seth Hardy"
        last_modified = "2014-06-20"
        
    condition:
        VidgrabCode or VidgrabStrings
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Vidgrab detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Media Asset Ingestion by Content Management Systems

  • Scenario: Automated nightly jobs from tools like Adobe Experience Manager (AEM) or SharePoint Online ingest large batches of video files for training modules. These processes often utilize the Vidgrab agent to generate thumbnails and metadata, triggering high-volume file creation events that mimic suspicious activity.
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\Adobe\AEM or C:\Program Files\Microsoft Office Root\VFS where the parent process is svchost.exe running under the LOCAL SERVICE account during business hours (02:00–06:00 UTC).

• Endpoint Security Scanning of Video Conferencing Records

  • Scenario: The enterprise endpoint protection suite, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs deep inspection on recorded meeting files stored in the C:\Users\Public\Videos\MsTeams directory. When scanning large .mp4 or .webm files, the security agent invokes Vidgrab to analyze file integrity, generating alerts that resemble unauthorized video processing.
  • Filter/Exclusion: Create an exclusion for events where the initiating process is MsMpEng.exe (Microsoft Defender) or CSFalconService.exe and the target file extension matches .mp4, .webm, or .mkv.

• IT Admin Deployment of Digital Signage Content

  • Scenario: System administrators use SCCM (System Center Configuration Manager) or Ansible Tower to push updated digital signage videos to lobby kiosks. This deployment task triggers Vidgrab on the target endpoints as it unpacks and registers