Windows Pcap Drivers — Sigma Rule

Rule metadata and linked tags

Author: Cian Heasley. Source status: test; severity: medium. Source dates: 2020-06-10 / 2023-04-14.

{
  "product": "windows",
  "service": "security",
  "definition": "The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: efda585fce185e2b7814cd95809eb2a45f3503fe9d44f2bf1e13d5e72c0ad834

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Windows Pcap Drivers
id: 7b687634-ab20-11ea-bb37-0242ac130002
status: test
description: Detects Windows Pcap driver installation based on a list of associated .sys files.
references:
    - https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more
author: Cian Heasley
date: 2020-06-10
modified: 2023-04-14
tags:
    - attack.discovery
    - attack.credential-access
    - attack.t1040
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains:
            - 'pcap'
            - 'npcap'
            - 'npf'
            - 'nm3'
            - 'ndiscap'
            - 'nmnt'
            - 'windivert'
            - 'USBPcap'
            - 'pktmon'
    condition: selection
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more