MITRE ATT&CK technique
Network Sniffing detection rulesT1040
Network Sniffing (T1040) is a MITRE ATT&CK technique in the Credential Access tactic. This page lists the 9 community-maintained Sigma detection rules in the library mapped to T1040 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, cisco, linux.
Tactic
Cisco Sniffing
mediumShow when a monitor or a span/rspan is setup or modified
cisco
Harvesting Of Wifi Credentials Via Netsh.EXE
mediumDetect the harvesting of wifi credentials using netsh.exe
windows · process_creation
New Network Trace Capture Started Via Netsh.EXE
mediumDetects the execution of netsh with the "trace" flag in order to start a network capture
windows · process_creation
PktMon.EXE Execution
mediumDetects execution of PktMon, a tool that captures network packets.
windows · process_creation
Potential Network Sniffing Activity Using Network Tools
mediumDetects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
windows · process_creation
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock
mediumDetects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.
windows · ps_script
Windows Pcap Drivers
mediumDetects Windows Pcap driver installation based on a list of associated .sys files.
windows
Network Sniffing - Linux
lowNetwork sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
linux
Network Sniffing - MacOs
informationalDetects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
macos · process_creation