Detection rules › Sigma

Windows native Pktmon sniffer abuse

Status
experimental
Severity
medium
Log source
product windows, category process_creation
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker use the Windows sniffer Pktmon in order to capture sensitive information or credentials.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1040 Network Sniffing

Event coverage

Rule body yaml

title: Windows native Pktmon sniffer abuse
description: Detects scenarios where an attacker use the Windows sniffer Pktmon in order to capture sensitive information or credentials.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1040-Traffic%20sniffing
- https://dev.to/qainsights/windows-network-sniffer-pktmon-2576
- https://docs.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon
tags:
- attack.credential_access
- attack.t1040 # Network Sniffing 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: '\PktMon.exe'
    CommandLine|contains|all: # full command : 'pktmon filter add -p 80'
      - pktmon
      - filter
      - add
  condition: selection
falsepositives:
- Administrator network troubleshooting
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  NewProcessName|endswith: '\PktMon.exe'
  CommandLine|contains|all:
    - pktmon
    - filter
    - add

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • add corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2)
  • filter
  • pktmon
NewProcessNameends_with
  • \PktMon.exe corpus 2 (sigma 2)