Detectionmediumtest
Potential Network Sniffing Activity Using Network Tools
Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems)Created Mon Oct 21Updated Mon Feb 20ba1f7802-adc7-48b4-9ecb-81e227fddfd5windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection_tshark:
Image|endswith: '\tshark.exe'
CommandLine|contains: '-i'
selection_windump:
Image|endswith: '\windump.exe'
condition: 1 of selection_*False Positives
Legitimate administration activity to troubleshoot network issues
References
MITRE ATT&CK
Techniques
Rule Metadata
Rule ID
ba1f7802-adc7-48b4-9ecb-81e227fddfd5
Status
test
Level
medium
Type
Detection
Created
Mon Oct 21
Modified
Mon Feb 20
Path
rules/windows/process_creation/proc_creation_win_susp_network_sniffing.yml
Raw Tags
attack.credential-accessattack.discoveryattack.t1040