Packet capture utility executed on a Windows host

1title: Packet capture utility executed on a Windows host2id: d44dd7fd-773c-405a-92b0-800d8710d77d3status: experimental4description: |5  Matches process creation of the capture engines and built-in tracing tools6  that put a Windows NIC into capture mode — the ToolNames half of AN0875,7  populated here with the Wireshark suite, the WinPcap/Npcap command-line8  ports, NirSoft's sniffer, Microsoft Network Monitor's collector, pktmon and9  a netsh packet capture. The netsh leg requires capture=yes alongside10  trace start, because netsh trace start on its own starts an ETW scenario11  trace and captures no packets — that form is Microsoft's standard12  troubleshooting step, not this technique. The capture engine is selected13  rather than the GUI on purpose: wireshark.exe never touches the adapter itself, it spawns14  dumpcap.exe, so a selector on the GUI name would miss every capture started15  from a script or from tshark. The brief maps Security EventID 4688 onto16  Sigma's process_creation category, which is Sysmon-shaped; this rule is17  written in that vocabulary (Image, CommandLine), so a Sysmon EventID 1 feed18  matches directly while a 4688 feed needs NewProcessName mapped onto Image19  first, plus Audit Process Creation enabled and the separate "Include command20  line in process creation events" policy before the netsh selection can ever21  match. AN0875's other leg — the capture driver arriving as a service22  install, System EventID 7045 — is a different log source and cannot be23  joined into one Sigma rule. A renamed binary, or a tool that links a capture24  library statically instead of shelling out, produces no match here at all.25  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0314, not hand-written and not tested by its author. Any lab result is on this rule's own page.26references:27  - https://attack.mitre.org/techniques/T104028  - https://attack.mitre.org/detectionstrategies/DET031429author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)30date: 2026-08-1631tags:32  - attack.credential-access33  - attack.discovery34  - attack.t104035logsource:36  category: process_creation37  product: windows38detection:39  selection_capture_tool:40    Image|endswith:41      - '\dumpcap.exe'42      - '\tshark.exe'43      - '\rawshark.exe'44      - '\windump.exe'45      - '\tcpdump.exe'46      - '\rawcap.exe'47      - '\netcap.exe'48      - '\nmcap.exe'49      - '\smsniff.exe'50      - '\pktmon.exe'51  selection_netsh_trace:52    Image|endswith: '\netsh.exe'53    CommandLine|contains|all:54      - 'trace start'55      - 'capture=yes'56  condition: 1 of selection*57falsepositives:58  - "Network and desktop engineers troubleshooting with Wireshark, which spawns dumpcap.exe for every capture. On the subset of hosts where the suite is installed this is the dominant volume the rule produces, and MITRE's ToolNames knob is better used to scope the rule by host than to drop tools from the list."59  - "Microsoft's own diagnostics, where netsh trace start capture=yes and pktmon.exe are the standard collection steps in the log-gathering scripts that Microsoft and third-party vendors hand to customers during a support case."60  - "Monitoring, VoIP call-quality and application-performance agents that bundle dumpcap or tshark and run scheduled or triggered captures on servers, producing a regular per-host rhythm from a fixed parent process."61  - "Lab, imaging and CI test harnesses that run windump.exe or tcpdump.exe to assert on network behaviour as part of an automated build or acceptance run."62level: medium