Techniques
Sample rules
Windows Network Sniffing Tool Executed
- source: splunk
- technicques:
Description
The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities. This activity is significant because attackers use packet capture tools to intercept and analyze network traffic, enabling credential theft, sensitive data harvesting, and reconnaissance of internal network communications. While these tools have legitimate administrative uses, their presence in unexpected environments may indicate an adversary conducting man-in-the-middle attacks or exfiltrating sensitive information traversing the network. If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Endpoint.Processes where
Processes.process_name IN (
"dumpcap.exe",
"netcap.exe",
"netmon.exe",
"tcpdump.exe",
"tshark.exe",
"windump.exe",
"winpcap.exe",
"wireshark.exe"
)
by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash
Processes.parent_process_name Processes.parent_process_exec Processes.action
Processes.dest Processes.process_current_directory Processes.process_path
Processes.process_integrity_level Processes.original_file_name Processes.parent_process
Processes.parent_process_path Processes.parent_process_guid
Processes.parent_process_id Processes.process_guid Processes.process_id
Processes.user Processes.process_name
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_network_sniffing_tool_executed_filter`