Packet capture utility executed on a Windows host

Siemphony@siemphonymediumT1040unverified

Matches process creation of the capture engines and built-in tracing tools that put a Windows NIC into capture mode — the ToolNames half of AN0875, populated here with the Wireshark suite, the WinPcap/Npcap command-line ports, NirSoft's sniffer, Microsoft Network Monitor's collector, pktmon and a netsh packet capture. The netsh leg requires capture=yes alongside trace start, because netsh trace start on its own starts an ETW scenario trace and captures no packets — that form is Microsoft's standard troubleshooting step, not this technique. The capture engine is selected rather than the GUI on purpose: wireshark.exe never touches the adapter itself, it spawns dumpcap.exe, so a selector on the GUI name would miss every capture started from a script or from tshark. The brief maps Security EventID 4688 onto Sigma's process_creation category, which is Sysmon-shaped; this rule is written in that vocabulary (Image, CommandLine), so a Sysmon EventID 1 feed matches directly while a 4688 feed needs NewProcessName mapped onto Image first, plus Audit Process Creation enabled and the separate "Include command line in process creation events" policy before the netsh selection can ever match. AN0875's other leg — the capture driver arriving as a service install, System EventID 7045 — is a different log source and cannot be joined into one Sigma rule. A renamed binary, or a tool that links a capture library statically instead of shelling out, produces no match here at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0314, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\dumpcap.exe" or FolderPath endswith "\\tshark.exe" or FolderPath endswith "\\rawshark.exe" or FolderPath endswith "\\windump.exe" or FolderPath endswith "\\tcpdump.exe" or FolderPath endswith "\\rawcap.exe" or FolderPath endswith "\\netcap.exe" or FolderPath endswith "\\nmcap.exe" or FolderPath endswith "\\smsniff.exe" or FolderPath endswith "\\pktmon.exe") or (FolderPath endswith "\\netsh.exe" and (ProcessCommandLine contains "trace start" and ProcessCommandLine contains "capture=yes")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\dumpcap.exe" OR Image="*\\tshark.exe" OR Image="*\\rawshark.exe" OR Image="*\\windump.exe" OR Image="*\\tcpdump.exe" OR Image="*\\rawcap.exe" OR Image="*\\netcap.exe" OR Image="*\\nmcap.exe" OR Image="*\\smsniff.exe" OR Image="*\\pktmon.exe") OR (Image="*\\netsh.exe" AND (CommandLine="*trace start*" AND CommandLine="*capture=yes*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\dumpcap.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tshark.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rawshark.exe" OR TO_LOWER(process.executable) LIKE "*\\\\windump.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tcpdump.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rawcap.exe" OR TO_LOWER(process.executable) LIKE "*\\\\netcap.exe" OR TO_LOWER(process.executable) LIKE "*\\\\nmcap.exe" OR TO_LOWER(process.executable) LIKE "*\\\\smsniff.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pktmon.exe") OR (TO_LOWER(process.executable) LIKE "*\\\\netsh.exe" AND (TO_LOWER(process.command_line) LIKE "*trace start*" AND TO_LOWER(process.command_line) LIKE "*capture=yes*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\dumpcap\.exe$|\\tshark\.exe$|\\rawshark\.exe$|\\windump\.exe$|\\tcpdump\.exe$|\\rawcap\.exe$|\\netcap\.exe$|\\nmcap\.exe$|\\smsniff\.exe$|\\pktmon\.exe$)</field>    <description>Packet capture utility executed on a Windows host (1/2)</description>    <mitre>      <id>T1040</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\netsh\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:trace start))(?=.*(?:capture=yes)).*</field>    <description>Packet capture utility executed on a Windows host (2/2)</description>    <mitre>      <id>T1040</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d44dd7fd-773c-405a-92b0-800d8710d77d

ATT&CKT1040

T1040Network Sniffing

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

AN0875 has three legs — sniffing tools executed, a capture driver loaded, and privilege changes to reach the NIC. This rule implements the first: process creation of the engines that actually put a Windows adapter into capture mode. It is a tool-execution rule, not a sniffing rule. Nothing in the logic separates a network engineer from an adversary; there is no user context, no parent process, no time-of-day test. A match tells you a capture tool started, and who started it is the triage question the rule hands you.

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN0875. The brief's underlying source is Security EventID 4688, but this Sigma category is Sysmon-shaped: the rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine), so a Sysmon feed matches directly while a raw 4688 feed needs NewProcessName mapped onto Image first. On 4688 you also need Audit Process Creation enabled and the separate Include command line in process creation events policy — neither is on by default or in the MS/CIS baselines — before the netsh leg can ever fire. All four backends render the rule. AN0875's driver leg is System EventID 7045, a different log source that cannot be joined into one Sigma rule.

03 · How the logic works

Two selections, OR-ed via condition: 1 of selection*. selection_capture_tool is Image|endswith over ten binaries — the Wireshark capture engines (dumpcap, tshark, rawshark), the pcap command-line ports (windump, tcpdump, rawcap), Network Monitor's collectors (netcap, nmcap), NirSoft's smsniff, and built-in pktmon. That list populates MITRE's ToolNames knob; the values are the pipeline's, not MITRE's. The engine is targeted, not the GUI, deliberately: wireshark.exe never touches the adapter, it spawns dumpcap.exe, so a selector on the GUI name misses every scripted or tshark-driven capture. selection_netsh_trace requires Image|endswith: '\netsh.exe' and CommandLine|contains|all: ['trace start', 'capture=yes']. The second string is load-bearing: bare netsh trace start runs an ETW scenario trace and captures no packets, so without it the leg fires on Microsoft's own troubleshooting step rather than on sniffing. \pktmon.exe has no such guard, so it matches pktmon stop, pktmon filter list and the bare help call — on every Windows 10 1809 and later host.

04 · Common false positives

Engineers troubleshooting with Wireshark, which spawns dumpcap.exe for every capture. On hosts where the suite is installed this is the dominant volume the rule produces. That is a calibration problem: the rule ships at medium while its own first false positive says benign use outweighs everything else, and sibling rules with that shape sit at low.
Behind it: Microsoft and vendor support scripts collecting with netsh trace … capture=yes and pktmon; monitoring, VoIP and APM agents that bundle dumpcap and capture on a schedule; CI harnesses running windump.

05 · Detection maturity

tier_1: the lowest tier, and it stays there until the rule has been run against real data. It was authored from a MITRE scaffold containing no query logic and has never been executed against a log line.
tier_2: run read-only, rank matches by host, user and parent process, and convert that into host scoping and the level decision above.
tier_3: ** join it to AN0875's driver leg (7045), so an alert means an adapter is capturing rather than a binary started.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Either drop to low, or keep medium and scope the rule to the server and
Split pktmon into its own selection requiring `CommandLine|contains:
Add a second selection on OriginalFileName (dumpcap.exe, tshark.exe,
Use MITRE's ToolNames knob to scope by host rather than to drop tools, and

Declared by the author

Network and desktop engineers troubleshooting with Wireshark, which spawns dumpcap.exe for every capture. On the subset of hosts where the suite is installed this is the dominant volume the rule produces, and MITRE's ToolNames knob is better used to scope the rule by host than to drop tools from the list.
Microsoft's own diagnostics, where netsh trace start capture=yes and pktmon.exe are the standard collection steps in the log-gathering scripts that Microsoft and third-party vendors hand to customers during a support case.
Monitoring, VoIP call-quality and application-performance agents that bundle dumpcap or tshark and run scheduled or triggered captures on servers, producing a regular per-host rhythm from a fixed parent process.
Lab, imaging and CI test harnesses that run windump.exe or tcpdump.exe to assert on network behaviour as part of an automated build or acceptance run.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1040, evaluated against their process_creation events.

Share this rule

/u/siemphony/d44dd7fd-773c-405a-92b0-800d8710d77d

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Packet capture utility executed on a Windows host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it