T1040

Network Sniffing

Credential Access Discovery Last updated:

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Data captured via this technique may include user credentials, especially those sent over insecure, unencrypted protocols such as FTP, HTTP Basic Auth, Telnet, POP3, IMAP, and LDAP. Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics necessary for subsequent Lateral Movement and Defense Evasion activities. In cloud-based environments, adversaries may use traffic mirroring services (AWS Traffic Mirroring, GCP Packet Mirroring, Azure vTap) to sniff network traffic from virtual machines. On network devices, adversaries may perform network captures using Network Device CLI commands such as 'monitor capture'. Threat actors including Sandworm Team, Kimsuky, APT33, and Salt Typhoon have used this technique with tools such as Intercepter-NG, SniffPass, Impacket, and custom sniffers.

What is T1040 Network Sniffing?

Network Sniffing (T1040) maps to the Credential Access and Discovery tactics — the adversary is trying to steal account names and passwords in MITRE ATT&CK.

This page provides production-ready detection logic for Network Sniffing, covering the data sources and telemetry it touches: Process: Process Creation, Module: Module Load, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Credential Access Discovery
Technique
T1040 Network Sniffing
Canonical reference
https://attack.mitre.org/techniques/T1040/
Microsoft Sentinel / Defender
kusto 
let SniffingToolNames = dynamic([
  "tcpdump", "tshark", "wireshark", "windump", "dumpcap",
  "rawshark", "networkMiner", "intercepter-ng", "sniffpass",
  "pcapdump", "ntopng", "capinfos", "editcap", "ssldump"
]);
let RawSocketPatterns = dynamic([
  "socket.AF_PACKET", "SOCK_RAW", "ETH_P_ALL",
  "pcap_open", "pcap_loop", "pcap_next", "libpcap",
  "scapy", "impacket"
]);
// Detection 1: Known packet capture tool execution
let SniffingProcesses = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (SniffingToolNames)
   or ProcessCommandLine has_any (SniffingToolNames)
| extend DetectionType = "KnownSniffingTool"
| extend CaptureToFile = ProcessCommandLine has "-w "
| extend PromiscuousMode = ProcessCommandLine has_any ("-i any", "promisc", "--promiscuous")
| extend TargetingCleartext = ProcessCommandLine has_any ("port 21", "port 23", "port 80", "port 110", "port 143", "port 389", "ftp", "telnet", "smtp", "ldap")
| project Timestamp, DeviceName, AccountName, AccountDomain,
         FileName, ProcessCommandLine, FolderPath,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, DetectionType,
         CaptureToFile, PromiscuousMode, TargetingCleartext;
// Detection 2: WinPcap / Npcap capture library loading by non-standard parents
let PcapDriverLoads = DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName has_any ("wpcap.dll", "npcap.dll", "Packet.dll", "npf.sys", "npcap.sys", "winpcap.sys")
   or FolderPath has_any ("\\npcap\\", "\\WinPcap\\")
| where InitiatingProcessFileName !in~ ("Wireshark.exe", "tshark.exe", "dumpcap.exe",
         "rawshark.exe", "capinfos.exe", "editcap.exe", "mergecap.exe")
| extend DetectionType = "PacketCaptureDriverLoad"
| extend CaptureToFile = false
| extend PromiscuousMode = false
| extend TargetingCleartext = false
| project Timestamp, DeviceName,
         AccountName = InitiatingProcessAccountName,
         AccountDomain = InitiatingProcessAccountDomain,
         FileName, ProcessCommandLine = InitiatingProcessCommandLine,
         FolderPath,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, DetectionType,
         CaptureToFile, PromiscuousMode, TargetingCleartext;
// Detection 3: Scripting languages using raw socket / pcap patterns
let RawSocketScripts = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("python.exe", "python3", "python3.exe", "perl.exe", "ruby.exe", "pwsh.exe", "powershell.exe")
| where ProcessCommandLine has_any (RawSocketPatterns)
| extend DetectionType = "RawSocketOrPcapViaScriptingLanguage"
| extend CaptureToFile = ProcessCommandLine has_any ("-w ", "wrpcap", "pcap_dump")
| extend PromiscuousMode = ProcessCommandLine has_any ("promisc", "AF_PACKET", "ETH_P_ALL")
| extend TargetingCleartext = ProcessCommandLine has_any ("port 21", "port 23", "port 80", "port 110", "port 389")
| project Timestamp, DeviceName, AccountName, AccountDomain,
         FileName, ProcessCommandLine, FolderPath,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, DetectionType,
         CaptureToFile, PromiscuousMode, TargetingCleartext;
union SniffingProcesses, PcapDriverLoads, RawSocketScripts
| sort by Timestamp desc

Detects network sniffing activity using Microsoft Defender for Endpoint tables. Covers three distinct detection signals: (1) execution of known packet capture tools (tcpdump, tshark, Wireshark, WinDump, NetworkMiner, Intercepter-NG) by process name or command line; (2) loading of WinPcap/Npcap packet capture DLLs and drivers by non-Wireshark parent processes — high-fidelity since legitimate business apps rarely load these libraries; (3) scripting languages (Python, PowerShell, Perl) invoking raw socket libraries such as Scapy or Impacket pcap functions. Enrichment fields flag captures writing to file (-w flag), promiscuous mode activation, and targeting of cleartext credential protocols to help analysts prioritize.

high severity medium confidence

Data Sources

Process: Process Creation Module: Module Load Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceImageLoadEvents

False Positives

  • Network administrators and security engineers using Wireshark, tshark, or tcpdump for legitimate network troubleshooting, packet analysis, or application protocol debugging
  • Vulnerability scanners (Nessus, Qualys, Rapid7) that load WinPcap/Npcap libraries during network discovery and host enumeration phases
  • Developer workstations where Wireshark, Scapy, or Impacket are installed for protocol research, application debugging, or CTF competitions
  • Dedicated network performance monitoring hosts (SolarWinds NPM, PRTG, ntopng) that continuously capture traffic for baseline analysis and alerting
  • Security Operations Center analyst machines running authorized packet captures during active incident response investigations

Sigma rule & cross-platform mapping

The detection logic for Network Sniffing (T1040) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1040 Sigma rules on detection.fyi

Platform-specific guides for T1040

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-16 Research depth: deep
References (12)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1tcpdump Passive Capture on All Interfaces (Linux/macOS)

    Expected signal: Linux auditd: execve syscall record for /usr/sbin/tcpdump with argv '-i any -w /tmp/t1040_capture_test.pcap -G 30 -W 1'. Kernel syslog/dmesg: '<interface>: entered promiscuous mode'. File creation event for /tmp/t1040_capture_test.pcap. Sysmon for Linux (if deployed) Event ID 1: Process Create with Image=/usr/sbin/tcpdump and CommandLine containing '-i any' and '-w'. File creation event (Sysmon Event ID 11) for the .pcap output.

  2. Test 2tshark Targeted Credential Protocol Capture (Windows)

    Expected signal: Sysmon Event ID 1: Process Create with Image=tshark.exe, CommandLine containing '-f "port 21 or port 23 or port 80 or port 389"', '-w', and output file path. Sysmon Event ID 7: wpcap.dll and npcap.dll loaded by tshark.exe (if not previously loaded). Sysmon Event ID 11: File Create for %TEMP%\t1040_cred_capture.pcapng. Windows System Event ID 7045 (if Npcap driver not previously installed and service is being created for first time).

  3. Test 3Python Scapy Raw Socket Packet Sniffing (Linux)

    Expected signal: Linux auditd: execve syscall for python3 with inline script containing 'scapy', 'sniff', 'SOCK_RAW', 'AF_PACKET'. Auditd socket syscall records for raw socket creation (socket(AF_PACKET, SOCK_RAW, ETH_P_ALL)). Sysmon for Linux Event ID 1 (if deployed): Process Create with Image=python3 and CommandLine matching 'scapy.*sniff'. No file creation event since data is held in memory only.

  4. Test 4WinDump Windows Packet Capture with Output File

    Expected signal: Sysmon Event ID 1: Process Create with Image=windump.exe, CommandLine '-i 1 -c 50 -w %TEMP%\t1040_windump_test.pcap'. Sysmon Event ID 7: wpcap.dll and Packet.dll loaded by windump.exe process. Sysmon Event ID 11: File Create for the .pcap output file. Windows System Event ID 7045 for NPF driver service installation if WinPcap was not previously installed (service name 'NPF').

Response Playbook

Triage

  1. Identify the tool and user — what binary was executed (tcpdump, tshark, windump, custom binary)? Is the account a domain admin, service account, network engineer, or standard user? Check if a change ticket or authorized activity record exists for this host and user at this time.
  2. Examine command line arguments — is capture writing to a file (-w flag)? What interface is targeted (-i any = all interfaces, -i eth0 = specific)? Are Berkeley Packet Filter (BPF) expressions targeting cleartext credential ports (port 21 FTP, port 23 Telnet, port 80 HTTP, port 110 POP3, port 143 IMAP, port 389 LDAP)? Credential-targeted captures require immediate escalation.
  3. Assess capture duration and file output — was a .pcap or .pcapng file written to disk? Locate the file: 'find / -name "*.pcap" -o -name "*.pcapng" 2>/dev/null' (Linux) or 'Get-ChildItem -Recurse -Include *.pcap,*.pcapng -Path C:\' (Windows). File size indicates duration; files >10MB represent sustained sniffing operations.
  4. Review parent process — was the sniffer launched interactively (terminal/cmd.exe parent) or via a script, scheduled task, service, or remote session (SSH, WinRM, RDP)? Remote-launched or service-spawned sniffers strongly indicate post-exploitation activity rather than legitimate admin work.
  5. Evaluate network position — is this host on a sensitive network segment with access to domain controller traffic, database server communications, payment networks, or executive subnets? A compromised host in a privileged network position with a sniffer running amplifies severity significantly.
  6. Check for lateral movement correlation — did any accounts authenticate to new hosts within 4 hours of the sniffing event? Review Event ID 4624/4648 on adjacent systems for new logon attempts from the compromised host's IP, which would indicate successful credential capture and reuse.

Containment

  1. If unauthorized sniffing confirmed: immediately isolate the endpoint via EDR network isolation or emergency VLAN reassignment. Every additional second of capture expands the credential exposure window.
  2. Terminate the sniffing process via EDR remote command or kill PID, then check for persistence: 'schtasks /query /fo LIST /v | findstr /i sniff' (Windows), 'crontab -l; systemctl list-units | grep -i pcap' (Linux). A persistent sniffer with auto-restart indicates a sophisticated adversary.
  3. Locate and preserve all capture files as evidence before deletion. Review file contents using tshark or Wireshark to determine exactly what was captured: 'tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e http.authorization -e ftp.password -e ldap.simple'. This determines breach scope and which credentials must be treated as compromised.
  4. Reset all credentials whose traffic transited the captured segment since the earliest confirmed sniffing timestamp. Treat all cleartext authentication (FTP, HTTP Basic, Telnet, SMTP AUTH, LDAP simple bind, NTLM on unencrypted channels) as fully compromised — do not wait for confirmation of specific capture content.
  5. If cloud traffic mirroring is involved: immediately audit and disable unauthorized sessions. AWS: 'aws ec2 describe-traffic-mirror-sessions --region <region>' and terminate with 'aws ec2 delete-traffic-mirror-session'. Azure: check Activity Log and delete vTap resources. GCP: 'gcloud compute packet-mirrorings list' and delete unauthorized policies. Revoke IAM credentials used to create them.
  6. Expand scope investigation — a network sniffer is typically a post-exploitation tool indicating prior compromise. The adversary already has execution on the host. Treat as full IR: check for persistence (scheduled tasks, services, modified startup), additional tooling, and data exfiltration of the capture files.

Evidence Collection

  1. Process creation logs — Sysmon Event ID 1 or Security Event ID 4688 with full command line. Command line arguments reveal interface targeting, BPF filter expressions, output file paths, and capture duration/count limits that establish scope of the sniffing operation.
  2. Capture files on disk — .pcap, .pcapng, .cap, .pcap.gz files are primary forensic evidence. Preserve with cryptographic hash before any analysis. Linux: 'find / -name "*.pcap" -o -name "*.pcapng" -o -name "*.cap" 2>/dev/null'. Windows: 'Get-ChildItem -Recurse -Include *.pcap,*.pcapng,*.cap -Path C:\ -ErrorAction SilentlyContinue'.
  3. Driver and library load events — Sysmon Event ID 7 for wpcap.dll, npcap.dll, Packet.dll loads. The first load timestamp establishes when packet capture capability was activated, potentially before process creation events if the library was pre-staged.
  4. Service installation events — Windows System Event ID 7045 for NPF/npcap driver. NPF service installation is the earliest durable indicator that WinPcap was installed on the system, predating actual capture activity.
  5. Network interface promiscuous mode state — Linux: 'ip link show | grep PROMISC' or 'cat /proc/net/packet'. Windows: 'netsh interface show interface'. Promiscuous mode persists after process termination and is a system-level artifact of sniffing activity.
  6. Authentication events post-sniffing — pull all Event ID 4624 (successful logon), 4648 (explicit credential logon), and 4768/4769 (Kerberos) events from the host and adjacent systems for the 48 hours following sniffing detection. Successful new logons with service account credentials indicate captured credentials in use.
  7. Cloud audit logs — AWS CloudTrail: filter for eventName in ['CreateTrafficMirrorSession', 'CreateTrafficMirrorTarget', 'CreateTrafficMirrorFilter', 'CreateTrafficMirrorFilterRule']. Azure Activity Log: filter for 'Microsoft.Network/virtualNetworkTaps/write'. GCP Cloud Audit Logs: filter for 'compute.packetMirrorings.insert'. Any of these from non-standard principals is a critical finding.
  8. Memory forensics — if no capture file was written to disk, adversary may have kept captured data in memory only. Live memory acquisition of the sniffing process can reveal captured packets, especially from tools like Scapy that default to in-memory storage.

Escalation Criteria

  • ! Sniffing tool launched via remote session (SSH, WinRM, RDP), scheduled task, or service — indicates established adversary foothold rather than accidental execution
  • ! BPF capture filter or tool targeting cleartext credential ports (FTP 21, Telnet 23, HTTP 80, POP3 110, IMAP 143, LDAP 389, SMTP 25) — confirms credential theft as primary objective
  • ! Capture files found on disk larger than 10MB, or evidence of capture files transferred off-host via SCP, FTP, HTTP POST, or cloud upload — indicates successful credential or data exfiltration
  • ! Sniffing activity on a host with network access to domain controller traffic, database server communications, or payment network segments — exposure scope is organization-critical
  • ! Cloud traffic mirroring session (AWS Traffic Mirror, Azure vTap, GCP Packet Mirroring) created by a non-standard IAM principal or in a production VPC — adversary has cloud-native persistent sniffing capability
  • ! Authentication events using service account credentials to new hosts within 4 hours of sniffing detection — indicates successful credential capture and active lateral movement in progress

Investigation Guide

Forensic Artifacts

  • > Capture files: .pcap, .pcapng, .cap, .pcap.gz — primary evidence; check user home directories, temp folders (%TEMP%, /tmp, /var/tmp), and any mounted network shares
  • > WinPcap registry: HKLM\SYSTEM\CurrentControlSet\Services\NPF — presence confirms WinPcap installation; Start value 3 (demand) vs 2 (auto) indicates whether service persists across reboots
  • > Npcap registry: HKLM\SYSTEM\CurrentControlSet\Services\npcap — same as above for Npcap; also check HKLM\SOFTWARE\Npcap for installation metadata including version and install timestamp
  • > Windows Prefetch: C:\Windows\Prefetch\WIRESHARK.EXE-*.pf, TSHARK.EXE-*.pf, WINDUMP.EXE-*.pf — execution timestamps and loaded DLL lists
  • > Windows: %APPDATA%\Wireshark\recent_files — recently opened capture files with full paths; reveals files that have since been deleted
  • > Linux: /var/log/audit/audit.log — auditd execve records for tcpdump, tshark, dumpcap showing exact arguments and timestamps
  • > Linux: kernel ring buffer via 'dmesg | grep -i promisc' — shows interface promiscuous mode activation with timestamps
  • > Linux: /proc/net/packet — active raw socket listeners; shows PID of processes holding raw sockets for packet capture
  • > Memory: Process memory of Python/Perl/Ruby sniffing scripts may contain captured packet data when no file is written — acquire full process memory dump via 'procdump -ma <PID>' (Windows) or 'gcore <PID>' (Linux)
  • > AWS: CloudTrail logs for ec2:CreateTrafficMirrorSession, ec2:CreateTrafficMirrorTarget with anomalous IAM principal; also check VPC Flow Logs for unexpected high-bandwidth traffic to mirror targets

Tuning Guidance

Begin by building an authorized inventory of hosts where packet capture tools are legitimately installed and operated: network engineering workstations, dedicated SOC analyst machines, vulnerability scanner servers, and network monitoring appliances. Create allowlist exceptions for these hosts and their associated service or user accounts. Review this inventory quarterly — tool installations spread without oversight. For the WinPcap/Npcap driver load signal, compile an exhaustive list of business applications in your environment that legitimately load wpcap.dll or npcap.dll. This list is typically very short (Wireshark suite, Nmap on analyst machines, specific vulnerability scanners). Any process outside this approved list loading these DLLs should fire without suppression — the false positive rate for this specific signal is very low. For Linux environments, augment detection with auditd rules targeting packet capture tool execution: -a always,exit -F arch=b64 -S execve -F path=/usr/sbin/tcpdump -k T1040_sniff -a always,exit -F arch=b64 -S execve -F path=/usr/bin/tshark -k T1040_sniff Also add a watch for promiscuous mode activation: -a always,exit -F arch=b64 -S setsockopt -k T1040_raw_socket For cloud environments: implement preventive SCPs (AWS) or Azure Policy to restrict TrafficMirrorSession creation to specific IAM roles. Set up dedicated CloudTrail/Activity Log alerts for any new traffic mirroring configuration — these should be vanishingly rare in normal operations and always require a change ticket. The packet capture file creation hunting query has an extremely low false positive rate outside dedicated capture hosts and is recommended as a weekly scheduled hunt. Tuning the confidence from medium to high is appropriate once you have a mature allowlist and can confirm all legitimate capture tools are inventoried. Until then, medium confidence with human triage is the appropriate posture given the frequency of legitimate network diagnostic use.

Hunting Queries

Hunt for packet capture files written to disk outside expected Wireshark installation directories. This query catches sustained or recurring sniffing activity where capture output is saved for later exfiltration. Large total file sizes (>10MB) indicate extensive captures. The SuspicionScore enrichment helps analysts prioritize high-volume capture operations that suggest deliberate credential collection rather than brief diagnostic captures.

Hunting — KQL
kql 
// Hunt for packet capture files written to disk in non-standard locations
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith ".pcap"
   or FileName endswith ".pcapng"
   or FileName endswith ".cap"
   or (FileName endswith ".pcap.gz" or FileName endswith ".cap.gz")
| where FolderPath !startswith "C:\\Program Files\\Wireshark"
   and FolderPath !startswith "C:\\Program Files (x86)\\Wireshark"
   and FolderPath !contains "\\AppData\\Local\\Temp\\Wireshark"
| summarize CaptureFileCount=count(),
            FilePaths=make_set(strcat(FolderPath, "\\", FileName), 10),
            TotalSizeBytes=sum(FileSize),
            Earliest=min(Timestamp),
            Latest=max(Timestamp)
  by DeviceName, RequestAccountName
| extend SuspicionScore = case(
    TotalSizeBytes > 104857600, 3,  // >100MB
    TotalSizeBytes > 10485760, 2,   // >10MB
    CaptureFileCount > 1, 1,
    0)
| where CaptureFileCount > 0
| sort by SuspicionScore desc, TotalSizeBytes desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.pcap" OR TargetFilename="*.pcapng" OR TargetFilename="*.cap")
  NOT (TargetFilename="*\\Wireshark\\*" OR TargetFilename="*Program Files*")
| stats count as CaptureFileCount,
        values(TargetFilename) as FilePaths,
        earliest(_time) as Earliest,
        latest(_time) as Latest
  by host, User
| eval SuspicionScore=if(CaptureFileCount > 5, 3, if(CaptureFileCount > 1, 2, 1))
| sort - SuspicionScore

Hunt for WinPcap/Npcap DLL loads by processes outside the official Wireshark tool suite. Legitimate business applications almost never require raw packet capture capabilities. Any unexpected parent process loading wpcap.dll or npcap.dll — especially scripting runtimes (python.exe, powershell.exe), custom binaries, or Impacket components — is a high-confidence indicator of adversary use of custom or framework-based network sniffing tools.

Hunting — KQL
kql 
// Hunt for WinPcap/Npcap DLL loads by unexpected parent processes
DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where FileName has_any ("wpcap.dll", "npcap.dll", "Packet.dll")
| where InitiatingProcessFileName !in~ (
    "Wireshark.exe", "tshark.exe", "dumpcap.exe", "rawshark.exe",
    "capinfos.exe", "editcap.exe", "mergecap.exe", "reordercap.exe"
  )
| summarize LoadCount=count(),
            UniqueHosts=dcount(DeviceName),
            ParentProcesses=make_set(InitiatingProcessFileName, 10),
            SampleCommands=make_set(InitiatingProcessCommandLine, 5),
            Earliest=min(Timestamp),
            Latest=max(Timestamp)
  by InitiatingProcessFileName, InitiatingProcessAccountName, FileName
| sort by LoadCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
  (ImageLoaded="*wpcap.dll" OR ImageLoaded="*npcap.dll" OR ImageLoaded="*Packet.dll")
  NOT (
    Image="*\\Wireshark.exe" OR Image="*\\tshark.exe" OR
    Image="*\\dumpcap.exe" OR Image="*\\rawshark.exe" OR
    Image="*\\capinfos.exe" OR Image="*\\editcap.exe" OR Image="*\\mergecap.exe"
  )
| stats count as LoadCount,
        dc(host) as UniqueHosts,
        values(Image) as ParentProcesses,
        values(CommandLine) as SampleCommands
  by Image, User, ImageLoaded
| sort - LoadCount

Hunt for network authentication events involving different accounts occurring within 6 hours of network sniffing activity on the same host. This temporal correlation pattern reveals the sniff-then-move attack sequence: an adversary captures cleartext credentials in transit, then uses those credentials to authenticate to additional systems. New remote logons (LogonType 3) using different account names than the sniffing process user are particularly suspicious.

Hunting — KQL
kql 
// Hunt for network sniffing correlated with subsequent lateral movement
let SniffingEvents = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has_any ("tcpdump", "tshark", "wireshark", "windump", "dumpcap", "intercepter")
   or ProcessCommandLine has_any ("scapy", "pcap_open", "SOCK_RAW", "AF_PACKET", "wpcap")
| project SniffTime=Timestamp, SniffDevice=DeviceName, SniffAccount=AccountName,
          SniffTool=FileName, SniffCmd=ProcessCommandLine;
let SubsequentLogons = DeviceLogonEvents
| where Timestamp > ago(7d)
| where LogonType in (3, 10)  // Network (3) and RemoteInteractive (10)
| where ActionType == "LogonSuccess"
| project LogonTime=Timestamp, LogonDevice=DeviceName,
          LogonAccount=AccountName, RemoteIP, LogonType;
SniffingEvents
| join kind=inner SubsequentLogons on $left.SniffDevice == $right.LogonDevice
| where LogonTime > SniffTime
| where LogonTime < datetime_add('hour', 6, SniffTime)
| where LogonAccount != SniffAccount
| extend HoursAfterSniff = datetime_diff('minute', LogonTime, SniffTime)
| project SniffTime, LogonTime, HoursAfterSniff, SniffDevice,
          SniffAccount, SniffTool, LogonAccount, RemoteIP, LogonType
| sort by SniffTime desc
Hunting — SPL
spl 
| tstats summarydata=t count min(_time) as SniffTime max(_time) as SniffEnd
    FROM datamodel=Endpoint.Processes
    WHERE (Processes.process_name IN ("tcpdump","tshark","wireshark","windump","dumpcap")
           OR Processes.process IN ("*scapy*","*pcap_open*","*AF_PACKET*"))
    BY Processes.dest Processes.user Processes.process_name
| rename Processes.dest AS SniffHost Processes.user AS SniffUser Processes.process_name AS SniffTool
| join type=inner SniffHost
  [search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 LogonType=3
   | eval LogonTime=_time
   | rename host as SniffHost
   | table LogonTime, SniffHost, TargetUserName, IpAddress]
| where LogonTime > SniffTime AND LogonTime < SniffTime + 21600
| where TargetUserName != SniffUser
| eval MinutesAfterSniff=round((LogonTime-SniffTime)/60,1)
| table SniffTime, LogonTime, MinutesAfterSniff, SniffHost, SniffUser, SniffTool, TargetUserName, IpAddress
| sort SniffTime

Atomic Red Team Tests

Test 1 tcpdump Passive Capture on All Interfaces (Linux/macOS)
linux

Performs a 30-second passive packet capture on all network interfaces using tcpdump with the '-i any' flag, writing output to a .pcap file. Simulates adversary use of tcpdump to capture cleartext credentials (FTP, HTTP Basic Auth, Telnet) or gather network reconnaissance data. The '-i any' flag activates promiscuous mode and is a hallmark of broad credential harvesting rather than targeted diagnostics.

Command

bash 
sudo tcpdump -i any -w /tmp/t1040_capture_test.pcap -G 30 -W 1 &
CAPTURE_PID=$!
echo "[*] Capture started, PID: $CAPTURE_PID"
sleep 5
echo "[*] Capture running for 30 seconds..."
wait $CAPTURE_PID
ls -la /tmp/t1040_capture_test.pcap

Cleanup

bash 
sudo pkill -f 'tcpdump.*t1040' 2>/dev/null; rm -f /tmp/t1040_capture_test.pcap

Expected Telemetry

Linux auditd: execve syscall record for /usr/sbin/tcpdump with argv '-i any -w /tmp/t1040_capture_test.pcap -G 30 -W 1'. Kernel syslog/dmesg: '<interface>: entered promiscuous mode'. File creation event for /tmp/t1040_capture_test.pcap. Sysmon for Linux (if deployed) Event ID 1: Process Create with Image=/usr/sbin/tcpdump and CommandLine containing '-i any' and '-w'. File creation event (Sysmon Event ID 11) for the .pcap output.

Expected Detection

KQL: FileName contains 'tcpdump', triggers KnownSniffingTool DetectionType; PromiscuousMode=true, CaptureToFile=true. SPL: Image matches '*tcpdump*', IsSniffProcess=1. File creation hunting query flags /tmp/t1040_capture_test.pcap as a capture file outside expected directories.

Test 2 tshark Targeted Credential Protocol Capture (Windows)
windows

Uses tshark (Wireshark command-line) to capture traffic filtered for cleartext credential protocols — FTP (port 21), HTTP (port 80), Telnet (port 23), and LDAP (port 389) — saving to a file in the Temp directory. This mirrors the targeting pattern used by APT33 and Kimsuky when using SniffPass to harvest credentials over insecure protocols. Requires Wireshark (including tshark) to be installed.

Command

powershell 
tshark.exe -i 1 -f "port 21 or port 23 or port 80 or port 389" -w %TEMP%\t1040_cred_capture.pcapng -a duration:60 -q

Cleanup

powershell 
del %TEMP%\t1040_cred_capture.pcapng 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=tshark.exe, CommandLine containing '-f "port 21 or port 23 or port 80 or port 389"', '-w', and output file path. Sysmon Event ID 7: wpcap.dll and npcap.dll loaded by tshark.exe (if not previously loaded). Sysmon Event ID 11: File Create for %TEMP%\t1040_cred_capture.pcapng. Windows System Event ID 7045 (if Npcap driver not previously installed and service is being created for first time).

Expected Detection

KQL: FileName =~ 'tshark.exe' triggers KnownSniffingTool; TargetingCleartext=true, CaptureToFile=true. SPL: Image matches '*\\tshark.exe', IsSniffProcess=1, TargetingCleartext=1. Driver load hunting query fires on wpcap.dll/npcap.dll. File creation hunting query flags the .pcapng output file.

Test 3 Python Scapy Raw Socket Packet Sniffing (Linux)
linux

Uses Python with the Scapy library to create a raw AF_PACKET promiscuous socket and capture packets directly — bypassing name-based detection rules targeting tcpdump/tshark. This technique is used by custom malware (CASTLETAP creates raw promiscuous sockets, Penquin uses libpcap) and frameworks (Impacket) to evade tool-name detection. No file is written to disk, demonstrating in-memory credential harvesting. Requires scapy installed: pip3 install scapy.

Command

bash 
python3 -c "
from scapy.all import sniff, IP, TCP, Raw
print('[*] Starting raw socket capture via Scapy (T1040 test)')
def pkt_callback(pkt):
    if IP in pkt and TCP in pkt:
        if pkt[TCP].dport in [21, 23, 80, 110, 143, 389] or pkt[TCP].sport in [21, 23, 80, 110, 143, 389]:
            print(f'[+] Cleartext protocol packet: {pkt[IP].src}:{pkt[TCP].sport} -> {pkt[IP].dst}:{pkt[TCP].dport}')
pkts = sniff(count=20, timeout=15, prn=pkt_callback, filter='tcp')
print(f'[*] Captured {len(pkts)} packets (in-memory, no file written)')
"

Expected Telemetry

Linux auditd: execve syscall for python3 with inline script containing 'scapy', 'sniff', 'SOCK_RAW', 'AF_PACKET'. Auditd socket syscall records for raw socket creation (socket(AF_PACKET, SOCK_RAW, ETH_P_ALL)). Sysmon for Linux Event ID 1 (if deployed): Process Create with Image=python3 and CommandLine matching 'scapy.*sniff'. No file creation event since data is held in memory only.

Expected Detection

KQL: RawSocketOrPcapViaScriptingLanguage DetectionType fires — FileName in~ 'python3', ProcessCommandLine has_any ('scapy', 'SOCK_RAW', 'AF_PACKET'). SPL: Image matches '*python3*', CommandLine matches '.*scapy.*sniff.*'. This test validates that detection is not solely reliant on tool-name matching — the process binary is python3, not a known sniffer.

Test 4 WinDump Windows Packet Capture with Output File
windows

Uses WinDump (the Windows port of tcpdump, requiring WinPcap) to capture packets on the first available network adapter, saving to a .pcap file in Temp. WinDump was used in Sandworm Team operations alongside Intercepter-NG. This test validates detection of WinPcap-based CLI sniffing tools that may be deployed as part of a post-exploitation toolkit. Requires WinDump.exe to be present (downloadable from winpcap.org or available in many offensive toolkits).

Command

powershell 
windump.exe -i 1 -c 50 -w %TEMP%\t1040_windump_test.pcap

Cleanup

powershell 
del %TEMP%\t1040_windump_test.pcap 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=windump.exe, CommandLine '-i 1 -c 50 -w %TEMP%\t1040_windump_test.pcap'. Sysmon Event ID 7: wpcap.dll and Packet.dll loaded by windump.exe process. Sysmon Event ID 11: File Create for the .pcap output file. Windows System Event ID 7045 for NPF driver service installation if WinPcap was not previously installed (service name 'NPF').

Expected Detection

KQL: FileName has 'windump' triggers KnownSniffingTool; CaptureToFile=true. SPL: Image matches '*windump*', IsSniffProcess=1, CaptureToFile=1. Secondary signal: Sysmon Event ID 7 for wpcap.dll loaded by windump.exe (PacketCaptureDriverLoad signal). File creation hunting query flags the .pcap output.

Related Detections

Tactic Hubs

TA0006Credential AccessTA0007Discovery

Related Techniques

T1557Adversary-in-the-MiddleT1557.001LLMNR/NBT-NS Poisoning and SMB RelayT1552.001Credentials In FilesT1003OS Credential DumpingT1021Remote ServicesT1041Exfiltration Over C2 ChannelT1048Exfiltration Over Alternative ProtocolT1046Network Service Discovery

Same Tactic: Credential Access

Popular Detections