Virtual Cameras and Video-Call Obfuscation Tooling

Devices showing any virtual-camera, face-swap or capture-card signal, with the signals listed so the strong ones can be read first.

// Replace the placeholder with the devices of media-production and training staff.
let MediaDevices = dynamic(["media-workstation-01"]);
let VirtualCameraImages = dynamic(["obs64.exe", "obs32.exe", "manycam.exe", "xsplit.core.exe"]);
union
  (DeviceProcessEvents
   | where Timestamp > ago(90d)
   | where ProcessCommandLine contains "Deep-Live-Cam"
        // optional: OBS, ManyCam and XSplit are ordinary software, the weakest part of this hunt
        or FileName in~ (VirtualCameraImages)
        or FolderPath contains "/OBS.app/" or FolderPath contains "/ManyCam.app/"
   | extend Signal = iff(ProcessCommandLine contains "Deep-Live-Cam", "deep-live-cam", "virtual-camera-tool"), Detail = FileName
   | project Timestamp, DeviceName, Signal, Detail),
  (DeviceFileEvents
   | where Timestamp > ago(90d)
   | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
   | where FileName startswith "inswapper_128" or FileName startswith "gfpgan-1024"
   | project Timestamp, DeviceName, Signal = "deep-live-cam-model", Detail = FileName),
  (DeviceEvents
   | where Timestamp > ago(90d)
   | where ActionType == "PnpDeviceConnected"
   | extend Fields = parse_json(AdditionalFields)
   | extend Description = tostring(Fields.DeviceDescription), UsbId = tostring(Fields.DeviceId)
   | where Description has "Guermok" or UsbId contains "VID_345F&PID_2130"
        // optional: chipset names shared by many generic capture cards
        or Description has_any ("UltraSemi", "MacroSilicon", "USB3 Video")
   | project Timestamp, DeviceName, Signal = "capture-card", Detail = Description)
| where DeviceName !in~ (MediaDevices)
| summarize Signals = make_set(Signal), Details = make_set(Detail, 10), LastSeen = max(Timestamp) by DeviceName
| sort by LastSeen desc

Hosts with a Deep-Live-Cam command line, model file or virtual-camera process, from Sysmon or EDR events.

```sourcetype placeholders: index=endpoint with Sysmon or EDR process and file events (process_name, process, file_name, host); USB enrolment is not in this form```
```optional: the process_name IN clause matches OBS, ManyCam and XSplit, ordinary software and the weakest part of this hunt```
index=endpoint earliest=-90d (process="*Deep-Live-Cam*" OR file_name IN ("inswapper_128*", "gfpgan-1024*") OR process_name IN ("obs64.exe", "obs32.exe", "manycam.exe", "xsplit.core.exe", "OBS", "ManyCam"))
| search NOT host IN ("media-workstation-01")
| eval signal=case(like(process, "%Deep-Live-Cam%"), "deep-live-cam", isnotnull(file_name), "deep-live-cam-model", true(), "virtual-camera-tool")
| eval detail=coalesce(process_name, file_name)
| stats values(signal) AS signals values(detail) AS details max(_time) AS last_seen BY host
| sort 0 - last_seen
| convert ctime(last_seen)

Two rules, one for the process start and one for the model files; USB enrolment has no Sigma category and is covered in the other languages.

title: Virtual Camera or Face-Swap Software Started
id: 0d6c2b9e-41f7-4c68-a3b5-2e8f91c7d604
status: experimental
description: >
  Detects the start of OBS, ManyCam or XSplit, or any process whose command
  line names Deep-Live-Cam, the open-source real-time face-swap application.
  OBS and ManyCam are named by DTEX in the DPRK IT-worker context; the
  Deep-Live-Cam project directory appears in the command line of the clone
  and of python run.py.
references:
  - https://www.dtex.ai/resources/i3-threat-advisory-inside-the-dprk/
  - https://github.com/hacksider/Deep-Live-Cam
logsource:
  category: process_creation
detection:
  selection_cmd:
    CommandLine|contains: 'Deep-Live-Cam'
  # optional: OBS, ManyCam and XSplit are ordinary software, the weakest part of this rule
  selection_tool:
    Image|endswith:
      - '\obs64.exe'
      - '\obs32.exe'
      - '\manycam.exe'
      - '\xsplit.core.exe'
  selection_tool_macos:
    Image|contains:
      - '/OBS.app/'
      - '/ManyCam.app/'
  condition: selection_cmd or selection_tool or selection_tool_macos
falsepositives:
  - Streamers, trainers and presenters who use OBS or ManyCam for their work
level: low
---
title: Deep-Live-Cam Face-Swap Model Written to Disk
id: 8b14e7a0-5c39-4d12-9f6a-73a0c5e1b2d8
status: experimental
description: >
  Detects the two ONNX models Deep-Live-Cam requires, the face-swap model
  inswapper_128 and the face-enhancement model gfpgan-1024, being written to
  disk. Roughly 300 MB of model data is fetched on first run.
references:
  - https://github.com/hacksider/Deep-Live-Cam
logsource:
  category: file_event
detection:
  selection_name:
    TargetFilename|contains:
      - 'inswapper_128'
      - 'gfpgan-1024'
  selection_ext:
    TargetFilename|endswith: '.onnx'
  condition: selection_name and selection_ext
falsepositives:
  - Researchers and developers who work with the same open face-swap models
level: medium

Hosts with a Deep-Live-Cam command line, model file or virtual-camera process in Elastic Defend events.

FROM logs-endpoint.events.process-*, logs-endpoint.events.file-*
| WHERE @timestamp > NOW() - 90 days
| WHERE NOT host.name IN ("media-workstation-01")
| EVAL signal = CASE(
    process.command_line LIKE "*Deep-Live-Cam*", "deep-live-cam",
    file.name LIKE "inswapper_128*" OR file.name LIKE "gfpgan-1024*", "deep-live-cam-model",
    TO_LOWER(process.name) IN ("obs64.exe", "obs32.exe", "manycam.exe", "xsplit.core.exe") OR process.executable LIKE "*/OBS.app/*" OR process.executable LIKE "*/ManyCam.app/*", "virtual-camera-tool")
| WHERE signal IS NOT NULL
| EVAL detail = COALESCE(process.name, file.name)
| STATS signals = VALUES(signal), details = VALUES(detail), last_seen = MAX(@timestamp) BY host.name
| SORT last_seen DESC
| LIMIT 200

Hosts that started Deep-Live-Cam or a virtual-camera tool in Falcon process events.

// Falcon process events only; model files and USB enrolments are not in this form.
#event_simpleName=ProcessRollup2
| CommandLine=/Deep-Live-Cam/i
  // optional: OBS, ManyCam and XSplit are ordinary software, the weakest part of this hunt
  or in(field=FileName, values=["obs64.exe", "obs32.exe", "manycam.exe", "xsplit.core.exe"], ignoreCase=true)
  or ImageFileName=/\/(OBS|ManyCam)\.app\//i
| !in(field=ComputerName, values=["media-workstation-01"])
| case { CommandLine=/Deep-Live-Cam/i | signal := "deep-live-cam"; * | signal := "virtual-camera-tool" }
| groupBy([aid, ComputerName], function=[collect(signal), collect(FileName), max(@timestamp, as=last_seen)])
| sort(last_seen, order=desc)

Hosts with a Deep-Live-Cam command line, model file or virtual-camera process in Cortex events.

dataset = xdr_data
| filter event_type in (ENUM.PROCESS, ENUM.FILE)
| filter agent_hostname not in ("media-workstation-01")
| alter signal = if(lowercase(action_process_image_command_line) contains "deep-live-cam", "deep-live-cam", if(lowercase(action_file_name) ~= "^(inswapper_128|gfpgan-1024).*\.onnx$", "deep-live-cam-model", null))
// optional: OBS, ManyCam and XSplit are ordinary software, the weakest part of this hunt
| alter signal = if(signal = null and lowercase(action_process_image_name) in ("obs64.exe", "obs32.exe", "manycam.exe", "xsplit.core.exe", "obs", "manycam"), "virtual-camera-tool", signal)
| filter signal != null
| comp values(signal) as signals, max(_time) as last_seen by agent_hostname
| sort desc last_seen

A point-in-time check of running processes, attached USB devices and model files under the user directories.

SELECT 'deep-live-cam' AS signal, name AS detail, cmdline AS location
FROM processes
WHERE cmdline LIKE '%Deep-Live-Cam%'
UNION ALL
SELECT 'capture-card', model, vendor
FROM usb_devices
WHERE (lower(vendor_id) = '345f' AND lower(model_id) = '2130')
   OR vendor LIKE '%Guermok%' OR model LIKE '%Guermok%'
   -- optional: chipset names shared by many generic capture cards
   OR vendor LIKE '%UltraSemi%' OR vendor LIKE '%MacroSilicon%' OR model LIKE '%USB3 Video%'
UNION ALL
SELECT 'deep-live-cam-model', filename, path
FROM file
WHERE path LIKE '/Users/%%/inswapper_128%' OR path LIKE '/Users/%%/gfpgan-1024%'
   OR path LIKE 'C:\Users\%%\inswapper_128%' OR path LIKE 'C:\Users\%%\gfpgan-1024%'
-- optional: OBS, ManyCam and XSplit are ordinary software, the weakest part of this hunt
UNION ALL
SELECT 'virtual-camera-tool', name, path
FROM processes
WHERE lower(name) IN ('obs', 'obs64.exe', 'obs32.exe', 'manycam', 'manycam.exe', 'xsplit.core.exe');