CmdID

CmdID / Techniques

T1040 Network Sniffing

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. MITRE ATT&CK

3 programs on CmdID 5 Sigma rules T1040 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
netsh.exeits Sigma rulesnmcap.exeReconnaissancepktmon.exeReconnaissance

Sigma rules tagged with it

process creation, the highest levels first
mediumHarvesting Of Wifi Credentials Via Netsh.EXEAndreas Hunkeler (@Karneades), oscd.community · Windows
mediumNew Network Trace Capture Started Via Netsh.EXEKutepov Anton, oscd.community · Windows
mediumPktMon.EXE Executionfrack113 · Windows
mediumPotential Network Sniffing Activity Using Network ToolsTimur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows
informationalNetwork Sniffing - MacOsAlejandro Ortuno, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

List available network interfaces on the page for tcpdump

tcpdump --list-interfacesIdentify

Capture the traffic of a specific interface on the page for tcpdump

sudo tcpdump --interface eth0Identify

Capture all TCP traffic showing contents (ASCII) in console on the page for tcpdump

sudo tcpdump -A tcpIdentify

Monitor packets from the default interface on the page for tshark

tsharkIdentify

Only capture packets matching a specific capture filter on the page for tshark

tshark -f 'udp port 53'Identify

Only show packets matching a specific output filter on the page for tshark

tshark -Y 'http.request.method == "GET"'Identify

To start a new trace session and save the log to a specific file path, run the following command on the page for netsh trace

netsh trace start capture=yes tracefile="C:\Logs\networktrace.etl"Identify

To start a capture session that collects only event tracing data and includes both broadcast and multicast events, run the following command on the page for netsh wfp

netsh wfp capture start traceonly=on keywords=BCAST+MCASTIdentify

The following set of filters will capture any ICMP traffic from or to the IP address 10.0.0.10 along with any traffic on port 53. on the page for pktmon filter add

C:\Test> pktmon filter add -i 10.0.0.10 -t icmp C:\Test> pktmon filter add -p 53Identify

The following filter will capture all the SYN packets sent or received by the IP address 10.0.0.10 on the page for pktmon filter add

C:\Test> pktmon filter add -i 10.0.0.10 -t tcp synIdentify

The following filter called MyPing pings 10.10.10.10 using the ICMP protocol on the page for pktmon filter add

C:\Test> pktmon filter add MyPing -i 10.10.10.10 -t ICMPIdentify

The following filter called MySmbSyb captures TCP synchronized SMB traffic on the page for pktmon filter add

C:\Test> pktmon filter add MySmbSyn -i 10.10.10.10 -t TCP SYN -p 445Identify

And 5 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1040: a Sigma rule it trips is tagged with it, or its abuse is documented as it.