Detection rules › Panther
Azure Network Packet Capture Enabled
Detects when Azure's Network Watcher packet capture feature is activated. Packet capture operations could enable threat actors to inspect unencrypted network traffic and potentially extract sensitive credentials or data. While packet capture is a legitimate network diagnostics tool, adversaries may abuse it to sniff credentials or intercept sensitive data in transit.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1040 Network Sniffing |
Rule body yaml
AnalysisType: rule
Filename: azure_network_packet_capture_enabled.py
RuleID: "Azure.MonitorActivity.Network.PacketCaptureEnabled"
DisplayName: "Azure Network Packet Capture Enabled"
Enabled: true
LogTypes:
- Azure.MonitorActivity
Severity: Medium
Description: >
Detects when Azure's Network Watcher packet capture feature is activated.
Packet capture operations could enable threat actors to inspect unencrypted
network traffic and potentially extract sensitive credentials or data. While packet capture
is a legitimate network diagnostics tool, adversaries may abuse it to sniff credentials or
intercept sensitive data in transit.
Reports:
MITRE ATT&CK:
- TA0006:T1040 # Credential Access: Network Sniffing
Tags:
- Credential Access
- Network Sniffing
Runbook: |
1. Query Azure Monitor Activity logs for all network diagnostic operations (packet capture start/stop, network watcher operations) by the callerIpAddress in the 24 hours before and after the alert
2. Find all packet capture sessions started in the past 6 hours to identify the scope of potential credential sniffing activity
3. Check if the callerIpAddress has enabled packet capture in the past 90 days to determine if this is typical network troubleshooting behavior
Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected.toml
SummaryAttributes:
- resourceId
- location
- callerIpAddress
- correlationId
Tests:
- Name: Packet Capture Started with STARTPACKETCAPTURE
ExpectedResult: true
Log:
{
"time": "2025-12-22T10:30:00.0000000Z",
"resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_eastus",
"operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/STARTPACKETCAPTURE/ACTION",
"operationVersion": "2021-05-01",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "1.1.1.1",
"correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"level": "Informational",
"location": "eastus",
"tenantId": "87654321-4321-4321-4321-111111111111"
}
- Name: VPN Packet Capture Started
ExpectedResult: true
Log:
{
"time": "2025-12-22T11:15:00.0000000Z",
"resourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_westeurope/vpnConnections/vpn-connection-01",
"operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION",
"category": "Administrative",
"resultType": "Succeeded",
"callerIpAddress": "2.2.2.2",
"correlationId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
"location": "westeurope",
"tenantId": "22222222-2222-2222-2222-222222222222"
}
- Name: Packet Capture Write Operation
ExpectedResult: true
Log:
{
"time": "2025-12-22T12:00:00.0000000Z",
"resourceId": "/subscriptions/33333333-3333-3333-3333-333333333333/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_centralus/packetCaptures/capture-01",
"operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/PACKETCAPTURES/WRITE",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "3.3.3.3",
"correlationId": "c3d4e5f6-a7b8-9012-cdef-333333333333",
"location": "centralus",
"tenantId": "33333333-3333-3333-3333-333333333333"
}
- Name: Different Operation
ExpectedResult: false
Log:
{
"time": "2025-12-22T14:00:00.0000000Z",
"resourceId": "/subscriptions/55555555-5555-5555-5555-555555555555/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_southcentralus",
"operationName": "MICROSOFT.NETWORK/NETWORKWATCHERS/WRITE",
"category": "Administrative",
"resultType": "Success",
"callerIpAddress": "5.5.5.5",
"correlationId": "e5f6a7b8-c9d0-1234-ef01-567890123456",
"tenantId": "55555555-5555-5555-5555-555555555555"
}
Detection logic
Condition
operationName contains "MICROSOFT.NETWORK/NETWORKWATCHERS/STARTPACKETCAPTURE/ACTION" or operationName contains "MICROSOFT.NETWORK/NETWORKWATCHERS/VPNCONNECTIONS/STARTPACKETCAPTURE/ACTION" or operationName contains "MICROSOFT.NETWORK/NETWORKWATCHERS/PACKETCAPTURES/WRITE"
resultType in ["Success", "Succeeded"]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
operationName | contains |
|
resultType | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
location |