DET0695 Detection of Video Capture

Item	Value
ID	DET0695
Version	1.0
Created	21 October 2025
Last Modified	21 October 2025

Technique Detected: T1512 (Video Capture)

Analytics

Android

AN1808

The user can view which applications have permission to use the camera through the device settings screen, where the user can then choose to revoke the permissions. During the vetting process, applications using the Android permission android.permission.CAMERA, or the iOS NSCameraUsageDescription plist entry could be given closer scrutiny.

Log Sources

Data Component	Name	Channel
System Settings (DC0118)	User Interface	None
Permissions Requests (DC0114)	Application Vetting	None

Mutable Elements

Field	Description

iOS

AN1809

The user can view which applications have permission to use the camera through the device settings screen, where the user can then choose to revoke the permissions. During the vetting process, applications using the Android permission android.permission.CAMERA, or the iOS NSCameraUsageDescription plist entry could be given closer scrutiny.

Log Sources

Data Component	Name	Channel
System Settings (DC0118)	User Interface	None
Permissions Requests (DC0114)	Application Vetting	None

Mutable Elements

Field	Description