Detect packet capture libraries loaded outside a capture install

1title: Detect packet capture libraries loaded outside a capture install2id: e43d625b-79e6-466d-865c-9aad554932903status: experimental4description: |5  A socket filter backdoor on Windows has to obtain raw packet visibility before6  it can watch for its trigger packet, and the libpcap route to that is loading7  the user-mode capture libraries MITRE names in the analytic's8  CaptureLibIndicators knob. This rule matches Module Load events for wpcap.dll9  or packet.dll and subtracts only processes running from a standard capture10  install directory. The exclusion is anchored on the install path rather than on11  the file name because a name-only allowlist is defeated by12  `copy implant.exe C:\Users\Public\tshark.exe` and, worse, publishes the exact13  names an attacker should use; anchoring on the directory also picks up14  nping.exe and ncat.exe, which ship beside nmap.exe and load the same library.15  Two gaps to be plain about. The raw-socket route (SIO_RCVALL on an AF_INET16  SOCK_RAW, or a WFP callout) acquires the same capability with no capture DLL17  and produces no event here, and the driver arm of the same knob — npcap.sys18  and npf.sys on Sysmon EID 6 — is a different logsource and is not expressed in19  this rule. Nothing at this layer touches the BPF filter that defines the20  sub-technique, so every alert is a sniffing event (T1040) of which a socket21  filter backdoor is a subset; the trigger-to-callback correlation that would22  separate them needs a join and a timer that Sigma has no construct for.23  UNVERIFIED — derived from MITRE ATT&CK DET0162 and never executed against logs.24references:25  - https://attack.mitre.org/techniques/T1205/00226  - https://attack.mitre.org/detectionstrategies/DET016227author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1629tags:30  - attack.defense-evasion31  - attack.persistence32  - attack.command-and-control33  - attack.t1205.00234  - attack.t104035logsource:36  category: image_load37  product: windows38detection:39  selection:40    ImageLoaded|endswith:41      - '\wpcap.dll'42      - '\packet.dll'43  filter_capture_installs:44    Image|startswith:45      - 'C:\Program Files\Wireshark\'46      - 'C:\Program Files (x86)\Wireshark\'47      - 'C:\Program Files\Npcap\'48      - 'C:\Program Files (x86)\Npcap\'49      - 'C:\Program Files\Nmap\'50      - 'C:\Program Files (x86)\Nmap\'51      - 'C:\Windows\System32\Npcap\'52  condition: selection and not filter_capture_installs53falsepositives:54  - "Portable or relocated capture tooling. Wireshark or Nmap run from a USB stick, a user profile or a non-default install root is not under any excluded path and alerts exactly like an implant would. MITRE's AllowedInstallers knob is where a site records which processes may legitimately acquire capture capability, and that list cannot be written in advance for someone else's fleet."55  - "Monitoring agents, VoIP quality probes, NAC clients and vulnerability scanners that link against the same libraries for their own capture needs. They load them once per service start, so the steady-state rate of this rule is set by service restarts and reboots across the fleet rather than by human activity — baseline the Image values for a week before enabling it, or the first patch Tuesday will look like an incident."56  - "The capture driver installer and its post-install self-test, which map both libraries once per deployment and once per upgrade wave, from a bootstrap executable that is not itself an analyser."57  - "Software distribution tooling that stages the capture runtime as a dependency of an unrelated product, so the loading image is a packaging or installer process running from a temp directory."58level: medium