LoFP / legitimate network diagnostic scripts.

Techniques

• t1040

Sample rules

Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock

• source: sigma
• technicques:
  • t1040

Description

Detects the execution of powershell scripts with calls to the “Start-NetEventSession” cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

Detection logic

condition: selection
selection:
  ScriptBlockText|contains: Start-NetEventSession