MITRE CAR unknown stable spl

Local Network Sniffing

Adversaries may use a variety of tools to gain visibility on the current status of things on the network: which processes are listening on which ports, which services are running on other hosts, etc. This analytic looks for the names of the most common network sniffing tools. While this may be noisy on networks where sysadmins are using any of these tools on a regular basis, in most networks their use is noteworthy.

View Source

Detection Logic

(index=__your_sysmon_index__ EventCode=1) (Image="*tshark.exe" 
OR Image="*windump.exe" 
OR (Image="*logman.exe" 
AND ParentImage!="?" 
AND ParentImage!="C:\\Program Files\\Windows Event Reporting\\Core\\EventReporting.AgentService.exe") 
OR Image="*tcpdump.exe" 
OR Image="*wprui.exe" 
OR Image="*wpr.exe")

Field Validations

Loading…

Comments (0)

Loading comments...