Detect packet capture libraries loaded outside a capture install

Siemphony@siemphonymediumT1040+1unverified

A socket filter backdoor on Windows has to obtain raw packet visibility before it can watch for its trigger packet, and the libpcap route to that is loading the user-mode capture libraries MITRE names in the analytic's CaptureLibIndicators knob. This rule matches Module Load events for wpcap.dll or packet.dll and subtracts only processes running from a standard capture install directory. The exclusion is anchored on the install path rather than on the file name because a name-only allowlist is defeated by `copy implant.exe C:\Users\Public\tshark.exe` and, worse, publishes the exact names an attacker should use; anchoring on the directory also picks up nping.exe and ncat.exe, which ship beside nmap.exe and load the same library. Two gaps to be plain about. The raw-socket route (SIO_RCVALL on an AF_INET SOCK_RAW, or a WFP callout) acquires the same capability with no capture DLL and produces no event here, and the driver arm of the same knob — npcap.sys and npf.sys on Sysmon EID 6 — is a different logsource and is not expressed in this rule. Nothing at this layer touches the BPF filter that defines the sub-technique, so every alert is a sniffing event (T1040) of which a socket filter backdoor is a subset; the trigger-to-callback correlation that would separate them needs a join and a timer that Sigma has no construct for. UNVERIFIED — derived from MITRE ATT&CK DET0162 and never executed against logs.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceImageLoadEvents| where ((FolderPath endswith "\\wpcap.dll" or FolderPath endswith "\\packet.dll") and not ((InitiatingProcessFolderPath startswith "C:\\Program Files\\Wireshark\\" or InitiatingProcessFolderPath startswith "C:\\Program Files (x86)\\Wireshark\\" or InitiatingProcessFolderPath startswith "C:\\Program Files\\Npcap\\" or InitiatingProcessFolderPath startswith "C:\\Program Files (x86)\\Npcap\\" or InitiatingProcessFolderPath startswith "C:\\Program Files\\Nmap\\" or InitiatingProcessFolderPath startswith "C:\\Program Files (x86)\\Nmap\\" or InitiatingProcessFolderPath startswith "C:\\Windows\\System32\\Npcap\\")))

Splunk · SPL

Run this as a search.

index=* ((ImageLoaded="*\\wpcap.dll" OR ImageLoaded="*\\packet.dll") AND NOT ((Image="C:\\Program Files\\Wireshark\\*" OR Image="C:\\Program Files (x86)\\Wireshark\\*" OR Image="C:\\Program Files\\Npcap\\*" OR Image="C:\\Program Files (x86)\\Npcap\\*" OR Image="C:\\Program Files\\Nmap\\*" OR Image="C:\\Program Files (x86)\\Nmap\\*" OR Image="C:\\Windows\\System32\\Npcap\\*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*\\\\wpcap.dll" OR TO_LOWER(file.path) LIKE "*\\\\packet.dll") AND NOT ((TO_LOWER(process.executable) LIKE "c:\\\\program files\\\\wireshark\\\\*" OR TO_LOWER(process.executable) LIKE "c:\\\\program files (x86)\\\\wireshark\\\\*" OR TO_LOWER(process.executable) LIKE "c:\\\\program files\\\\npcap\\\\*" OR TO_LOWER(process.executable) LIKE "c:\\\\program files (x86)\\\\npcap\\\\*" OR TO_LOWER(process.executable) LIKE "c:\\\\program files\\\\nmap\\\\*" OR TO_LOWER(process.executable) LIKE "c:\\\\program files (x86)\\\\nmap\\\\*" OR TO_LOWER(process.executable) LIKE "c:\\\\windows\\\\system32\\\\npcap\\\\*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,image_load,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ImageLoaded" type="pcre2">(?i)(\\wpcap\.dll$|\\packet\.dll$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(^C:\\Program Files\\Wireshark\\|^C:\\Program Files \(x86\)\\Wireshark\\|^C:\\Program Files\\Npcap\\|^C:\\Program Files \(x86\)\\Npcap\\|^C:\\Program Files\\Nmap\\|^C:\\Program Files \(x86\)\\Nmap\\|^C:\\Windows\\System32\\Npcap\\)</field>    <description>Detect packet capture libraries loaded outside a capture install</description>    <mitre>      <id>T1205.002</id>      <id>T1040</id>    </mitre>  </rule></group>

At a glance

Logsource: image_load / windows
Level: medium
Category: covert_c2_channels
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 3 Sept 2026
Rule ID: e43d625b-79e6-466d-865c-9aad55493290

ATT&CKT1040 +1

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoncovert c2 channels

covert c2 channelsAI draft — unreviewed

01 · What this rule detects

A socket-filter backdoor watches every packet on the wire until it sees the one crafted packet that wakes it up. To watch at all it needs raw packet visibility, and on Windows that means loading the user-mode WinPcap/Npcap libraries. This rule matches a Sysmon Module Load event where wpcap.dll or packet.dll is mapped into a process, then subtracts the programs that are supposed to load them. It does not detect the backdoor. It detects the step before: a process acquiring capture capability while not being a packet analyser.

02 · Telemetry you need

Sysmon EventID 7 (Module Load) — the image_load / windows logsource from
AN0462 lists six sources (7045, process creation, Sysmon 3, 22, 6 and 7). A

03 · How the logic works

Why the DLL and not the process. The backdoor's filename is whatever the adversary chose. The library name is fixed by the Npcap API contract — any program that wants packets must load wpcap.dll. Selecting on the thing the attacker cannot rename is the whole idea. Both names come from MITRE's CaptureLibIndicators knob; npcap.sys and npf.sys from that same knob are absent because kernel drivers are the driver_load logsource, a different rule. The leading backslash in '\wpcap.dll' anchors on the path separator, so mywpcap.dll does not match — one character, one class of noise removed. Why the author excluded analysers instead of narrowing the inclusion. You cannot enumerate malicious loaders; you do not know their names. You can enumerate the legitimate ones. So the rule casts the widest net and subtracts, and an unknown implant still matches by default. The failure mode is noise, not blindness — the right direction when the target is unnamed. What the exclusion costs. Image|endswith '\dumpcap.exe' is a filename check, so a renamed dumpcap.exe, or an implant called tshark.exe, walks through. MITRE's AllowedInstallers knob says signed/expected processes for exactly this reason. Sysmon EventID 7 carries Signed and Signature, but they describe the loaded module, not the loading process — you cannot sign-check the loader from this event alone. The limitation that teaches the most. DET0162 describes a correlation: an inbound trigger packet, then the capture-loading process connecting outbound to the packet's origin, inside TimeWindow (MITRE's default 120 seconds). That is a join across three log sources plus a timer, and Sigma has neither. So the rule models the one leg that is a single event. Treat it as an input to a correlation you build in the SIEM, not as the detection itself.

04 · Common false positives

Troubleshooting from a portable or renamed capture binary not on the
Monitoring agents, VoIP quality probes and vulnerability scanners linking
The Npcap installer and its post-install self-test, once per upgrade wave.
Distribution tooling staging the capture runtime as a dependency of an

05 · Detection maturity

tier_1: . Authored from MITRE's scaffold, never executed against a log line, and structurally incapable of expressing the analytic it derives from. A hit is not evidence of a backdoor; it is "this host has a program with packet visibility that I did not expect".
tier_2: baseline it read-only, catalogue every process in your estate that legitimately loads these libraries, and turn that into a path- and signature-based `AllowedInstallers` filter.
tier_3: ** MITRE's correlation — feed this rule into a stateful query watching the same PID for an outbound connection inside TimeWindow, ideally against ReversePorts. Only there is this a T1205.002 detection rather than a capability-acquisition alert.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Fill in MITRE's `AllowedInstallers` knob with your fleet's own list. The
Move the exclusion from filename to full path (`Image|startswith: 'C:\Program
Separate steady-state loaders from novel ones. An agent loading wpcap.dll
Write the companion driver_load rule for npcap.sys / npf.sys and the

Declared by the author

Portable or relocated capture tooling. Wireshark or Nmap run from a USB stick, a user profile or a non-default install root is not under any excluded path and alerts exactly like an implant would. MITRE's AllowedInstallers knob is where a site records which processes may legitimately acquire capture capability, and that list cannot be written in advance for someone else's fleet.
Monitoring agents, VoIP quality probes, NAC clients and vulnerability scanners that link against the same libraries for their own capture needs. They load them once per service start, so the steady-state rate of this rule is set by service restarts and reboots across the fleet rather than by human activity — baseline the Image values for a week before enabling it, or the first patch Tuesday will look like an incident.
The capture driver installer and its post-install self-test, which map both libraries once per deployment and once per upgrade wave, from a bootstrap executable that is not itself an analyser.
Software distribution tooling that stages the capture runtime as a dependency of an unrelated product, so the loading image is a packaging or installer process running from a temp directory.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1205.002, T1040, evaluated against their image_load events.

Share this rule

/u/siemphony/e43d625b-79e6-466d-865c-9aad55493290

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect packet capture libraries loaded outside a capture install

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it