{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1040","id":"T1040","name":"Network Sniffing","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1040","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"9593c4e22bea79fe219b5f2846ace869849a3516a7eb54d5bf2062f11afdf4db","description":"Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.\n\nData captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [Name Resolution Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.\n\nNetwork sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and/or [Stealth](https://attack.mitre.org/tactics/TA0005) activities. Adversaries may likely also utilize network sniffing during [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) (AiTM) to passively gain additional knowledge about the environment.\n\nIn cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)(Citation: SpecterOps AWS Traffic Mirroring) The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)\n\nOn network devices, adversaries may perform network captures using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `monitor capture`.(Citation: US-CERT-TA18-106A)(Citation: capture_embedded_packet_on_software)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1040","external_id":"T1040"},{"source_name":"AWS Traffic Mirroring","description":"Amazon Web Services. (n.d.). How Traffic Mirroring works. Retrieved March 17, 2022.","url":"https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-how-it-works.html"},{"source_name":"capture_embedded_packet_on_software","description":"Cisco. (2022, August 17). Configure and Capture Embedded Packet on Software. Retrieved July 13, 2022.","url":"https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html"},{"source_name":"GCP Packet Mirroring","description":"Google Cloud. (n.d.). Packet Mirroring overview. Retrieved March 17, 2022.","url":"https://cloud.google.com/vpc/docs/packet-mirroring"},{"source_name":"SpecterOps AWS Traffic Mirroring","description":"Luke Paine. (2020, March 11). Through the Looking Glass — Part 1. Retrieved March 17, 2022.","url":"https://posts.specterops.io/through-the-looking-glass-part-1-f539ae308512"},{"source_name":"Azure Virtual Network TAP","description":"Microsoft. (2022, February 9). Virtual network TAP. Retrieved March 17, 2022.","url":"https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview"},{"source_name":"Rhino Security Labs AWS VPC Traffic Mirroring","description":"Spencer Gietzen. (2019, September 17). Abusing VPC Traffic Mirroring in AWS. Retrieved March 17, 2022.","url":"https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws/"},{"source_name":"US-CERT-TA18-106A","description":"US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"}],"platforms":["IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0060","name":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component","category":"Windows and directory audit","description":"Installation or registration of a service.","collection_focus":"Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","action","executable","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1040","id":"T1040","name":"Network Sniffing","domain":"enterprise","platforms":["IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T1040","technique_page":"techniques/enterprise/T1040/","page":"detections/enterprise/T1040/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"f4d3748a-65d1-4806-bd23-e25728081d01","title":"Network Sniffing - Linux","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/f4d3748a-65d1-4806-bd23-e25728081d01.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_network_sniffing.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"adc9bcc4-c39c-4f6b-a711-1884017bf043","title":"Network Sniffing - MacOs","status":"test","level":"informational","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/adc9bcc4-c39c-4f6b-a711-1884017bf043.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_network_sniffing.yml","author":"Alejandro Ortuno, oscd.community","kind":"sigma"},{"id":"b9e1f193-d236-4451-aaae-2f3d2102120d","title":"Cisco Sniffing","status":"test","level":"medium","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/b9e1f193-d236-4451-aaae-2f3d2102120d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_net_sniff.yml","author":"Austin Clark","kind":"sigma"},{"id":"7b687634-ab20-11ea-bb37-0242ac130002","title":"Windows Pcap Drivers","status":"test","level":"medium","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/7b687634-ab20-11ea-bb37-0242ac130002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_pcap_drivers.yml","author":"Cian Heasley","kind":"sigma"},{"id":"da34e323-1e65-42db-83be-a6725ac2caa3","title":"Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/da34e323-1e65-42db-83be-a6725ac2caa3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml","author":"frack113","kind":"sigma"},{"id":"d3c3861d-c504-4c77-ba55-224ba82d0118","title":"New Network Trace Capture Started Via Netsh.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d3c3861d-c504-4c77-ba55-224ba82d0118.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_netsh_packet_capture.yml","author":"Kutepov Anton, oscd.community","kind":"sigma"},{"id":"42b1a5b8-353f-4f10-b256-39de4467faff","title":"Harvesting Of Wifi Credentials Via Netsh.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/42b1a5b8-353f-4f10-b256-39de4467faff.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml","author":"Andreas Hunkeler (@Karneades), oscd.community","kind":"sigma"},{"id":"f956c7c1-0f60-4bc5-b7d7-b39ab3c08908","title":"PktMon.EXE Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f956c7c1-0f60-4bc5-b7d7-b39ab3c08908.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pktmon_execution.yml","author":"frack113","kind":"sigma"},{"id":"ba1f7802-adc7-48b4-9ecb-81e227fddfd5","title":"Potential Network Sniffing Activity Using Network Tools","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ba1f7802-adc7-48b4-9ecb-81e227fddfd5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_network_sniffing.yml","author":"Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0314","name":"Detection Strategy for Network Sniffing Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0314","stix_id":"x-mitre-detection-strategy--49505f6d-b778-4a84-a072-9236b700e7b5","relationship_id":"relationship--0dcf6c3b-b899-4ee4-99ad-cad56967f9ca","description":"","analytics":[{"id":"AN0875","name":"Analytic 0875","guidance":"Detects suspicious execution of network monitoring tools (e.g., Wireshark, tshark, Microsoft Message Analyzer), driver loading indicative of promiscuous mode, or non-admin user privilege escalation to access NICs for capture.","url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0875","platforms":["Windows"],"tuning":[{"field":"ToolNames","description":"Adjust list of known sniffing tools based on environment and known administrator usage."},{"field":"TimeWindow","description":"Tune time of day or frequency of capture sessions to reduce false positives from authorized use."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0875","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0875","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0060","component":"Service Creation","name":"WinEventLog:System","channel":"EventCode=7045","platforms":["Windows"],"analytic_id":"AN0875","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0875","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"}]},{"id":"AN0876","name":"Analytic 0876","guidance":"Correlates interface mode changes to promiscuous with execution of sniffing tools like tcpdump, tshark, or custom pcap libraries. Detects abnormal NIC configurations and unauthorized sniffing from non-root sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0876","platforms":["Linux"],"tuning":[{"field":"InterfaceList","description":"Limit analysis to external interfaces (e.g., eth0, wlan0) and exclude virtual adapters."},{"field":"PromiscuousSessionThreshold","description":"Raise alerts if interface remains in PROMISC longer than threshold duration."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve, setifflags","platforms":["Linux"],"analytic_id":"AN0876","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0876","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"promiscuous mode transitions (ioctl or ifconfig)","platforms":["Linux"],"analytic_id":"AN0876","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0876","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"networkconfig ","channel":"interface flag PROMISC, netstat | ip link | ethtool","platforms":["Linux"],"analytic_id":"AN0876","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0876","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0877","name":"Analytic 0877","guidance":"Detects enabling of interface sniffing via packet capture tools or AppleScript triggering `tcpdump`. Leverages Unified Logs and process lineage to identify suspicious use of `pfctl`, `tcpdump`, or `libpcap` libraries.","url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0877","platforms":["macOS"],"tuning":[{"field":"AllowedTools","description":"Whitelist Apple-native tools used by IT admins and mobile device management (MDM)."},{"field":"UserContext","description":"Prioritize detections from non-admin or low-privilege users performing packet captures."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"macos:unifiedlog","channel":"eventMessage = 'promiscuous'","platforms":["macOS"],"analytic_id":"AN0877","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0877","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"process_events where path like '%tcpdump%'","platforms":["macOS"],"analytic_id":"AN0877","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0877","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"fs:fsusage","channel":"access to BPF devices or interface IOCTLs","platforms":["macOS"],"analytic_id":"AN0877","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0877","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0878","name":"Analytic 0878","guidance":"Detects creation of traffic mirroring sessions (e.g., AWS VPC Traffic Mirroring, Azure vTAP) that redirect traffic from critical assets to other virtual instances, often followed by file creation or session establishment.","url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0878","platforms":["IaaS"],"tuning":[{"field":"MirrorSourceList","description":"Identify VMs or containers where mirror sessions are abnormal or unexpected."},{"field":"TargetIAMRole","description":"Monitor whether mirror target roles match administrative expectations."}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"AWS:CloudTrail","channel":"CreateTrafficMirrorSession / ModifyTrafficMirrorTarget","platforms":["IaaS"],"analytic_id":"AN0878","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0878","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"}]},{"id":"AN0879","name":"Analytic 0879","guidance":"Detects execution of capture commands via CLI (`monitor capture`, `debug packet`, etc.) or unauthorized CLI access followed by logging configuration changes on Cisco/Juniper/Arista gear.","url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0879","platforms":["Network Devices"],"tuning":[{"field":"AdminSessionDuration","description":"Tunable alerting threshold for interactive CLI sessions."},{"field":"CaptureCommandList","description":"Define set of known capture/debug commands per vendor to flag unexpected usage."}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"networkdevice:syslog","channel":"admin login events","platforms":["Network Devices"],"analytic_id":"AN0879","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0879","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"exec command='monitor capture'","platforms":["Network Devices"],"analytic_id":"AN0879","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0879","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"networkdevice:syslog","channel":"config change (e.g., logging buffered, pcap buffers)","platforms":["Network Devices"],"analytic_id":"AN0879","source_url":"https://attack.mitre.org/detectionstrategies/DET0314#AN0879","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0357","name":"Impacket","page":"tools/S0357/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0590","name":"NBTscan","page":"tools/S0590/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0174","name":"Responder","page":"tools/S0174/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0357","name":"Impacket","page":"tools/S0357/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0590","name":"NBTscan","page":"tools/S0590/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0174","name":"Responder","page":"tools/S0174/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0019","name":"Regin","url":"https://attack.mitre.org/software/S0019","kind":"malware","description":"[Regin](https://attack.mitre.org/software/S0019) appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.(Citation: Kaspersky Regin)","relationship_id":"relationship--fcfe071b-e527-44e9-9970-9243a354f563","references":[{"source_name":"Kaspersky Regin","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, November 24). THE REGIN PLATFORM NATION-STATE OWNAGE OF GSM NETWORKS. Retrieved December 1, 2014.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"}]},{"id":"S0174","name":"Responder","url":"https://attack.mitre.org/software/S0174","kind":"tool","description":"[Responder](https://attack.mitre.org/software/S0174) captures hashes and credentials that are sent to the system after the name services have been poisoned.(Citation: GitHub Responder)","relationship_id":"relationship--9c012fcf-876b-4101-aa28-6af8b00a51d2","references":[{"source_name":"GitHub Responder","description":"Gaffie, L. (2016, August 25). Responder. Retrieved November 17, 2017.","url":"https://github.com/SpiderLabs/Responder"}]},{"id":"S0357","name":"Impacket","url":"https://attack.mitre.org/software/S0357","kind":"tool","description":"[Impacket](https://attack.mitre.org/software/S0357) can be used to sniff network traffic via an interface or raw socket.(Citation: Impacket Tools)","relationship_id":"relationship--191d6679-d6a8-42e3-b5ff-84a8d5bfb1dd","references":[{"source_name":"Impacket Tools","description":"SecureAuth. (n.d.).  Retrieved January 15, 2019.","url":"https://www.secureauth.com/labs/open-source-tools/impacket"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) can be used to conduct packet captures on target hosts.(Citation: Github PowerShell Empire)","relationship_id":"relationship--9be360bb-8ac4-4357-8795-0736b447293c","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0367","name":"Emotet","url":"https://attack.mitre.org/software/S0367","kind":"malware","description":"[Emotet](https://attack.mitre.org/software/S0367) has been observed to hook network APIs to monitor network traffic. (Citation: Trend Micro Banking Malware Jan 2019)","relationship_id":"relationship--aa6d74b0-3db2-4679-bf1c-03d3dd7561b0","references":[{"source_name":"Trend Micro Banking Malware Jan 2019","description":"Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) contains a module for taking packet captures on compromised hosts.(Citation: GitHub PoshC2)","relationship_id":"relationship--f9fb0958-7f80-4bd5-80c2-9665124f1d0e","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0443","name":"MESSAGETAP","url":"https://attack.mitre.org/software/S0443","kind":"malware","description":"[MESSAGETAP](https://attack.mitre.org/software/S0443) uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.  (Citation: FireEye MESSAGETAP October 2019)","relationship_id":"relationship--3318f441-6593-4a7b-bb7f-53ab15a1a672","references":[{"source_name":"FireEye MESSAGETAP October 2019","description":"Leong, R., Perez, D., Dean, T. (2019, October 31). MESSAGETAP: Who’s Reading Your Text Messages?. Retrieved May 11, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html"}]},{"id":"S0587","name":"Penquin","url":"https://attack.mitre.org/software/S0587","kind":"malware","description":"[Penquin](https://attack.mitre.org/software/S0587) can sniff network traffic to look for packets matching specific conditions.(Citation: Leonardo Turla Penquin May 2020)(Citation: Kaspersky Turla Penquin December 2014)","relationship_id":"relationship--9148cfab-450f-4aa7-a427-3ddf8e8d686a","references":[{"source_name":"Kaspersky Turla Penquin December 2014","description":"Baumgartner, K. and Raiu, C. (2014, December 8). The ‘Penquin’ Turla. Retrieved March 11, 2021.","url":"https://securelist.com/the-penquin-turla-2/67962/"},{"source_name":"Leonardo Turla Penquin May 2020","description":"Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}]},{"id":"S0590","name":"NBTscan","url":"https://attack.mitre.org/software/S0590","kind":"tool","description":"[NBTscan](https://attack.mitre.org/software/S0590) can dump and print whole packet content.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)\t","relationship_id":"relationship--306eba85-eeb9-4fcb-8b23-ce38b09bbf24","references":[{"source_name":"Debian nbtscan Nov 2019","description":"Bezroutchko, A. (2019, November 19). NBTscan man page. Retrieved March 17, 2021.","url":"https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html"},{"source_name":"SecTools nbtscan June 2003","description":"SecTools. (2003, June 11). NBTscan. Retrieved March 17, 2021.","url":"https://sectools.org/tool/nbtscan/"}]},{"id":"S0661","name":"FoggyWeb","url":"https://attack.mitre.org/software/S0661","kind":"malware","description":"[FoggyWeb](https://attack.mitre.org/software/S0661) can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.(Citation: MSTIC FoggyWeb September 2021)","relationship_id":"relationship--98b8b974-ac4f-4286-b657-f34f813c1d12","references":[{"source_name":"MSTIC FoggyWeb September 2021","description":"Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}]},{"id":"S1154","name":"VersaMem","url":"https://attack.mitre.org/software/S1154","kind":"malware","description":"[VersaMem](https://attack.mitre.org/software/S1154) hooked the Catalina application filter chain `doFilter` on compromised systems to monitor all inbound requests to the local Tomcat web server, inspecting them for parameters like passwords and follow-on Java modules.(Citation: Lumen Versa 2024)","relationship_id":"relationship--fc57736f-1142-4385-82a1-8baf6b6eedc6","references":[{"source_name":"Lumen Versa 2024","description":"Black Lotus Labs. (2024, August 27). Taking The Crossroads: The Versa Director Zero-Day Exploitaiton. Retrieved August 27, 2024.","url":"https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/"}]},{"id":"S1186","name":"Line Dancer","url":"https://attack.mitre.org/software/S1186","kind":"malware","description":"[Line Dancer](https://attack.mitre.org/software/S1186) can create and exfiltrate packet captures from compromised environments.(Citation: Cisco ArcaneDoor 2024)","relationship_id":"relationship--bca32067-c031-46fd-83dd-c1b33994d16e","references":[{"source_name":"Cisco ArcaneDoor 2024","description":"Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"}]},{"id":"S1203","name":"J-magic","url":"https://attack.mitre.org/software/S1203","kind":"malware","description":"[J-magic](https://attack.mitre.org/software/S1203) has a pcap listener function that can create an Extended Berkley Packet Filter (eBPF) on designated interfaces and ports.(Citation: Lumen J-Magic JAN 2025)","relationship_id":"relationship--d5cd9334-11f1-42c8-b332-8a0aa884e254","references":[{"source_name":"Lumen J-Magic JAN 2025","description":"Black Lotus Labs. (2025, January 23). The J-Magic Show: Magic Packets and Where to find them. Retrieved February 17, 2025.","url":"https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"}]},{"id":"S1204","name":"cd00r","url":"https://attack.mitre.org/software/S1204","kind":"malware","description":"[cd00r](https://attack.mitre.org/software/S1204) can use the libpcap library to monitor captured packets for specifc sequences.(Citation: Hartrell cd00r 2002)","relationship_id":"relationship--ba8a5719-2e23-4bdf-9029-59a3babd66f6","references":[{"source_name":"Hartrell cd00r 2002","description":"Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible backdoor. Retrieved October 13, 2018.","url":"https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631"}]},{"id":"S1206","name":"JumbledPath","url":"https://attack.mitre.org/software/S1206","kind":"malware","description":"[JumbledPath](https://attack.mitre.org/software/S1206) has the ability to perform packet capture on remote devices via actor-defined jump-hosts.(Citation: Cisco Salt Typhoon FEB 2025)","relationship_id":"relationship--335ed0b0-c96a-4868-9443-d45d05c16ba8","references":[{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"id":"S1224","name":"CASTLETAP","url":"https://attack.mitre.org/software/S1224","kind":"malware","description":"[CASTLETAP](https://attack.mitre.org/software/S1224) has the ability to create a raw promiscuous socket to sniff network traffic.(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--4d4e832b-28f4-4ee6-a173-dfae05df0eaf","references":[{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"id":"S9024","name":"SPAWNCHIMERA","url":"https://attack.mitre.org/software/S9024","kind":"malware","description":"[SPAWNCHIMERA](https://attack.mitre.org/software/S9024) has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control. (Citation: Google UNC5221 Ivanti January 2025)(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)","relationship_id":"relationship--aa03a8fe-d67f-43b8-8108-c877734044e5","references":[{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","description":"Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials.(Citation: FireEye APT28)(Citation: FireEye APT28 Hospitality Aug 2017) [APT28](https://attack.mitre.org/groups/G0007) close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.(Citation: US District Court Indictment GRU Oct 2018)","relationship_id":"relationship--cb69217e-f063-4093-bcf0-f051ecd42e25","references":[{"source_name":"US District Court Indictment GRU Oct 2018","description":"Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"},{"source_name":"FireEye APT28 Hospitality Aug 2017","description":"Smith, L. and Read, B.. (2017, August 11). APT28 Targets Hospitality Sector, Presents Threat to Travelers. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20171202185937/https://www.fireeye.com/blog/threat-research/2017/08/apt28-targets-hospitality-sector.html"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used intercepter-NG to sniff passwords in network traffic.(Citation: ESET Telebots Dec 2016)\t","relationship_id":"relationship--03f1e3ee-5c1b-4897-8631-d15ed48a0730","references":[{"source_name":"ESET Telebots Dec 2016","description":"Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"id":"G0064","name":"APT33","url":"https://attack.mitre.org/groups/G0064","kind":"intrusion-set","description":"[APT33](https://attack.mitre.org/groups/G0064) has used SniffPass to collect credentials by sniffing network traffic.(Citation: Symantec Elfin Mar 2019)","relationship_id":"relationship--b1ca60ac-cef2-467e-843c-5732d8885626","references":[{"source_name":"Symantec Elfin Mar 2019","description":"Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.(Citation: CISA AA20-301A Kimsuky)(Citation: Netscout Stolen Pencil Dec 2018)","relationship_id":"relationship--0f36ee85-8906-40c6-be53-87bc96499763","references":[{"source_name":"CISA AA20-301A Kimsuky","description":"CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source_name":"Netscout Stolen Pencil Dec 2018","description":"ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019.","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"}]},{"id":"G0105","name":"DarkVishnya","url":"https://attack.mitre.org/groups/G0105","kind":"intrusion-set","description":"[DarkVishnya](https://attack.mitre.org/groups/G0105) used network sniffing to obtain login data. (Citation: Securelist DarkVishnya Dec 2018)","relationship_id":"relationship--c2ba1f7a-1951-47df-855b-3f42a60a9901","references":[{"source_name":"Securelist DarkVishnya Dec 2018","description":"Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.","url":"https://securelist.com/darkvishnya/89169/"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has used a variety of tools and techniques to capture packet data between network interfaces.(Citation: Cisco Salt Typhoon FEB 2025)(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)","relationship_id":"relationship--706be608-c046-402e-ad71-c6042e0f88f2","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"},{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"id":"G1047","name":"Velvet Ant","url":"https://attack.mitre.org/groups/G1047","kind":"intrusion-set","description":"[Velvet Ant](https://attack.mitre.org/groups/G1047) has used a custom tool, \"VELVETTAP\", to perform packet capture from compromised F5 BIG-IP devices.(Citation: Sygnia VelvetAnt 2024A)","relationship_id":"relationship--4d20e130-46a0-4dbe-ac36-ea620e187770","references":[{"source_name":"Sygnia VelvetAnt 2024A","description":"Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has used the LOOKOVER sniffer to sniff TACACS+ authentication packets.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--b707b5ce-7bc7-4373-bc1e-dad8cb81e74c","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"In cloud environments, ensure that users are not granted permissions to create or modify traffic mirrors unless this is explicitly required.","relationship_id":"relationship--075cdcb0-5a29-4ebb-bb0d-c2b22a5acec8","references":[]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Deny direct access of broadcasts and multicast sniffing, and prevent attacks such as [Name Resolution Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001)","relationship_id":"relationship--d6a77085-88e6-4446-8613-2933d1f3f55e","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Use multi-factor authentication wherever possible.","relationship_id":"relationship--0ccddf91-2cf3-4801-a10b-ca4d253f2c8c","references":[]},{"id":"M1041","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M1041","kind":"course-of-action","description":"Ensure that all wired and/or wireless traffic is encrypted appropriately. Use best practices for authentication protocols, such as Kerberos, and ensure web traffic that may contain credentials is protected by SSL/TLS.","relationship_id":"relationship--70d446a5-349f-4b70-9446-90e872adac42","references":[]}],"candidates":[{"id":"10c710c9-9104-4d5f-8829-5b65391e2a29","name":"Packet Capture Linux socket AF_PACKET,SOCK_RAW with sudo","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Captures packets with domain=AF_PACKET, type=SOCK_RAW for a few seconds.\n","inputs":{"csource_path":{"description":"Path to C program source","type":"string","default":"PathToAtomicsFolder/T1040/src/linux_pcapdemo.c"},"program_path":{"description":"Path to compiled C program","type":"string","default":"/tmp/t1040_linux_pcapdemo"}},"dependencies":[{"description":"compile C program\n"}],"source_definition_sha256":"1922380dbbafffe6d424651d250aa006b2966194f04fe338dca3462afc169b9e"},{"id":"515575ab-d213-42b1-aa64-ef6a2dd4641b","name":"Packet Capture Linux socket AF_INET,SOCK_PACKET,UDP with sudo","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Captures packets with domain=AF_INET,type=SOCK_PACKET,protocol=UDP for a few seconds.\nSOCK_PACKET is \"obsolete\" according to the man page, but still works on Ubuntu 20.04\n","inputs":{"csource_path":{"description":"Path to C program source","type":"string","default":"PathToAtomicsFolder/T1040/src/linux_pcapdemo.c"},"program_path":{"description":"Path to compiled C program","type":"string","default":"/tmp/t1040_linux_pcapdemo"}},"dependencies":[{"description":"compile C program\n"}],"source_definition_sha256":"228f32cf7f1d40c07f1c621ed00902d7f059b44f0d0771b868229d2b7a31b95b"},{"id":"7a0895f0-84c1-4adf-8491-a21510b1d4c1","name":"Packet Capture Linux socket AF_INET,SOCK_RAW,TCP with sudo","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Captures packets with domain=AF_INET,type=SOCK_RAW,protocol=TCP for a few seconds.\n","inputs":{"csource_path":{"description":"Path to C program source","type":"string","default":"PathToAtomicsFolder/T1040/src/linux_pcapdemo.c"},"program_path":{"description":"Path to compiled C program","type":"string","default":"/tmp/t1040_linux_pcapdemo"}},"dependencies":[{"description":"compile C program\n"}],"source_definition_sha256":"6922a8cc42334dd681bbfdc864f669af0569cfec135a572b8dbb6af0b019c1ba"},{"id":"7fe741f7-b265-4951-a7c7-320889083b3e","name":"Packet Capture Linux using tshark or tcpdump","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.\n\nUpon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.\n","inputs":{"interface":{"description":"Specify interface to perform PCAP on.","type":"string","default":"ens33"}},"dependencies":[{"description":"Check if at least one of tcpdump or tshark is installed.\n"}],"source_definition_sha256":"604b2bb704464b8d78ec59b4d92913217faa28d179e182100de909003637d279"},{"id":"855fb8b4-b8ab-4785-ae77-09f5df7bff55","name":"Windows Internal pktmon set filter","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Select Desired ports for packet capture \nhttps://lolbas-project.github.io/lolbas/Binaries/Pktmon/","inputs":{},"dependencies":[],"source_definition_sha256":"f71b8fb53969ef097d13ff32d02b7a6a84ad5ee4bba7de00ab51c29234fbfdca"},{"id":"9c15a7de-de14-46c3-bc2a-6d94130986ae","name":"PowerShell Network Sniffing","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"PowerShell Built-in Cmdlets to capture network traffic.\nhttps://learn.microsoft.com/en-us/powershell/module/neteventpacketcapture/new-neteventsession?view=windowsserver2022-ps","inputs":{},"dependencies":[],"source_definition_sha256":"671ce8823dc3698c4f6ebf5d1610ce0b99460165ca0905266a0b5c6b9e8b05fd"},{"id":"9d04efee-eff5-4240-b8d2-07792b873608","name":"Packet Capture macOS using tcpdump or tshark","platforms":["macos"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Perform a PCAP on macOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed.\n\nUpon successful execution, tshark or tcpdump will execute and capture 5 packets on interface en0A.\n","inputs":{"interface":{"description":"Specify interface to perform PCAP on.","type":"string","default":"en0A"}},"dependencies":[{"description":"Check if at least one of tcpdump or tshark is installed.\n"}],"source_definition_sha256":"84ac5d734c61386f6614097b1c8022efa095fa041bce7d833a42d4e0010903b9"},{"id":"a3a0d4c9-c068-4563-a08d-583bd05b884c","name":"Filtered Packet Capture FreeBSD using /dev/bpfN with sudo","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.\n","inputs":{"ifname":{"description":"Specify interface to perform PCAP on.","type":"string","default":"em0"},"csource_path":{"description":"Path to C program source","type":"string","default":"PathToAtomicsFolder/T1040/src/freebsd_pcapdemo.c"},"program_path":{"description":"Path to compiled C program","type":"string","default":"/tmp/t1040_freebsd_pcapdemo"}},"dependencies":[{"description":"compile C program\n"}],"source_definition_sha256":"d5fffc3ec46c94138369678c709a419f0c5dc9c98e02d978ba1e9aee62a99ab3"},{"id":"a5b2f6a0-24b4-493e-9590-c699f75723ca","name":"Packet Capture Windows Command Prompt","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":2,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark\ninstalled.\n\nUpon successful execution, tshark will execute and capture 5 packets on interface \"Ethernet\".\n","inputs":{"interface":{"description":"Specify interface to perform PCAP on.","type":"string","default":"Ethernet"},"wireshark_url":{"description":"wireshark installer download URL","type":"url","default":"https://1.eu.dl.wireshark.org/win64/Wireshark-latest-x64.exe"},"tshark_path":{"description":"path to tshark.exe","type":"path","default":"c:\\program files\\wireshark\\tshark.exe"},"npcap_url":{"description":"npcap installed download URL","type":"url","default":"https://nmap.org/npcap/dist/npcap-1.31.exe"},"npcap_path":{"description":"path to npcap.sys","type":"path","default":"C:\\Program Files\\Npcap\\npcap.sys"}},"dependencies":[{"description":"tshark must be installed and in the default path of \"c:\\Program Files\\Wireshark\\Tshark.exe\".\n"},{"description":"npcap must be installed.\n"}],"source_definition_sha256":"0eb51d11a8bf09aec24a75f5f508c9ab8bbefe0fbc7851cd870c34e55750b1bb"},{"id":"b1cbdf8b-6078-48f5-a890-11ea19d7f8e9","name":"Packet Capture Linux socket AF_PACKET,SOCK_RAW with BPF filter for UDP with sudo","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Captures packets with domain=AF_PACKET,type=SOCK_RAW for a few seconds.\nSets a BPF filter on the socket to filter for UDP traffic.\n","inputs":{"csource_path":{"description":"Path to C program source","type":"string","default":"PathToAtomicsFolder/T1040/src/linux_pcapdemo.c"},"program_path":{"description":"Path to compiled C program","type":"string","default":"/tmp/t1040_linux_pcapdemo"}},"dependencies":[{"description":"compile C program\n"}],"source_definition_sha256":"b0ac9001d56066080ccacc234e8011bb054ba9a1e95e9b039dbed11a6fd6cffb"},{"id":"b5656f67-d67f-4de8-8e62-b5581630f528","name":"Windows Internal Packet Capture","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Uses the built-in Windows packet capture\nAfter execution you should find a file named trace.etl and trace.cab in the temp directory","inputs":{},"dependencies":[],"source_definition_sha256":"d88658039b41bcaa97c77928710f9a3ada67a9ded26d060e9e0be5003996be4d"},{"id":"c67ba807-f48b-446e-b955-e4928cd1bf91","name":"Windows Internal pktmon capture","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Will start a packet capture and store log file as t1040.etl.\nhttps://lolbas-project.github.io/lolbas/Binaries/Pktmon/","inputs":{},"dependencies":[],"source_definition_sha256":"46eaa42bb635a20767a2a64a3df6effd7fbde5929a8c1a8613871df4a08ca951"},{"id":"c93f2492-9ebe-44b5-8b45-36574cccfe67","name":"Packet Capture FreeBSD using tshark or tcpdump","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.\n\nUpon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.\n","inputs":{"interface":{"description":"Specify interface to perform PCAP on.","type":"string","default":"em0"}},"dependencies":[{"description":"Check if at least one of tcpdump or tshark is installed.\n"}],"source_definition_sha256":"2edca07bb0bceb8457f065a412da36a745ff199ff1fe5faa7915f99780e7fed6"},{"id":"e2028771-1bfb-48f5-b5e6-e50ee0942a14","name":"Packet Capture FreeBSD using /dev/bpfN with sudo","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.\n","inputs":{"ifname":{"description":"Specify interface to perform PCAP on.","type":"string","default":"em0"},"csource_path":{"description":"Path to C program source","type":"string","default":"PathToAtomicsFolder/T1040/src/freebsd_pcapdemo.c"},"program_path":{"description":"Path to compiled C program","type":"string","default":"/tmp/t1040_freebsd_pcapdemo"}},"dependencies":[{"description":"compile C program\n"}],"source_definition_sha256":"d72e796d6534577f793b4fbbc9dc5d5541bbfad1d0f8c04becb3f52985cc8c94"},{"id":"e2480aee-23f3-4f34-80ce-de221e27cd19","name":"Filtered Packet Capture macOS using /dev/bpfN with sudo","platforms":["macos"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.\n","inputs":{"ifname":{"description":"Specify interface to perform PCAP on.","type":"string","default":"en0"},"csource_path":{"description":"Path to C program source","type":"string","default":"PathToAtomicsFolder/T1040/src/macos_pcapdemo.c"},"program_path":{"description":"Path to compiled C program","type":"string","default":"/tmp/t1040_macos_pcapdemo"}},"dependencies":[{"description":"compile C program\n"}],"source_definition_sha256":"8316da7b93d678c1d8e15929449cc1295c2b60a0f5e9e0fae546503e0e0a0290"},{"id":"e6fe5095-545d-4c8b-a0ae-e863914be3aa","name":"Packet Capture macOS using /dev/bpfN with sudo","platforms":["macos"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml","description":"Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.\n","inputs":{"ifname":{"description":"Specify interface to perform PCAP on.","type":"string","default":"en0"},"csource_path":{"description":"Path to C program source","type":"string","default":"PathToAtomicsFolder/T1040/src/macos_pcapdemo.c"},"program_path":{"description":"Path to compiled C program","type":"string","default":"/tmp/t1040_macos_pcapdemo"}},"dependencies":[{"description":"compile C program\n"}],"source_definition_sha256":"1a02d1df361b5d2ad5c95e55e4792f525e6120c1826916ec61785e3f6b277231"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1557.001":"/ttp-simulation/techniques/enterprise/T1557.001/","T1557":"/ttp-simulation/techniques/enterprise/T1557/","T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/","T1040":"/ttp-simulation/techniques/enterprise/T1040/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1040","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}