PktMon.EXE Execution

A Sigma rule for process creation on Windows, by frack113.

medium 1 ATT&CK technique 1 program it names 9 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    - Image|endswith: '\pktmon.exe'
    - OriginalFileName: 'PktMon.exe'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by frack113, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

The following set of filters will capture any ICMP traffic from or to the IP address 10.0.0.10 along with any traffic on port 53. on the page for pktmon filter add

C:\Test> pktmon filter add -i 10.0.0.10 -t icmp
C:\Test> pktmon filter add -p 53

Identify

The following filter will capture all the SYN packets sent or received by the IP address 10.0.0.10 on the page for pktmon filter add

C:\Test> pktmon filter add -i 10.0.0.10 -t tcp synIdentify

The following filter called MyPing pings 10.10.10.10 using the ICMP protocol on the page for pktmon filter add

C:\Test> pktmon filter add MyPing -i 10.10.10.10 -t ICMPIdentify

The following filter called MySmbSyb captures TCP synchronized SMB traffic on the page for pktmon filter add

C:\Test> pktmon filter add MySmbSyn -i 10.10.10.10 -t TCP SYN -p 445Identify

The following filter called MySubnet captures traffic on the subnet mask 255.255.255.0, or /24 in CIDR notation on the page for pktmon filter add

C:\Test> pktmon filter add MySubnet -i 10.10.10.0/24Identify

Example 1: Packet capture on the page for pktmon start

C:\Test> pktmon start --captureIdentify

Example 2: Packet counters only on the page for pktmon start

C:\Test> pktmon start --capture --counters-onlyIdentify

Example 3: Event logging on the page for pktmon start

C:\Test> pktmon start --trace -p Microsoft-Windows-TCPIP -p Microsoft-Windows-NDISIdentify

Example 4: Packet capture with event logging on the page for pktmon start

C:\Test> pktmon start --capture --trace -p Microsoft-Windows-TCPIP -k 0xFF -l 4Identify

The commands LOLBAS or GTFOBins documents for pktmon.exe trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here

pktmon.exe

ATT&CK

the techniques it is tagged with

T1040Network Sniffing

PktMon.EXE Execution

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1040 Network Sniffing