The non-crazy speculation I've seen is that they were using FLIR to scan the crowd for weapons and explosives.
@PeteS in CA I'd have to see what the nose of the helicopters looked like to be able to know if they were using FLIR.
There is a different shaped nose on the Blackhawks where the FLIR is contained and on the UH 72's they do make a scout model and the FLIR is mounted on the right rear side of the fuselage in what looks like a mount for a security camera.
And of course there are IIRC hand held models that someone could sit inside and aim at the crowd.
And considering the fact the President, the AG and Chairman of the Joint Chiefs were walking out into the middle of everything, I d be more surprised if they hadn't used FLIR to locate potential threats.