Detectionmediumtest

Windows Pcap Drivers

Detects Windows Pcap driver installation based on a list of associated .sys files.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Cian HeasleyCreated Wed Jun 10Updated Fri Apr 147b687634-ab20-11ea-bb37-0242ac130002windows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Definition

The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697

Detection Logic

detection:
    selection:
        EventID: 4697
        ServiceFileName|contains:
            - 'pcap'
            - 'npcap'
            - 'npf'
            - 'nm3'
            - 'ndiscap'
            - 'nmnt'
            - 'windivert'
            - 'USBPcap'
            - 'pktmon'
    condition: selection