Linux Auditd: Detect Execution of tcpdump or tshark with Interface Flag

Alerts on tcpdump or tshark executions on Linux where an interface flag is present, consistent with network sniffing.

FreeUnreviewedSigmalowv1

linux-auditd-detect-execution-of-tcpdump-or-tshark-with-interface-flag-f4d3748a

title: "Linux Auditd: Detect Execution of tcpdump or tshark with Interface Flag"
id: 5036dedf-f8a5-4caf-99f9-90f6fbf94ce8
status: test
description: This rule flags Linux processes started via execve for tcpdump or tshark when the command line includes an interface selection flag (a3 contains "-i") and uses a packet count flag (-c). Network sniffing tools can be used by an attacker to passively collect data from network traffic or observe communications for further targeting. It relies on auditd telemetry capturing process execution arguments (executable and command-line fields) for Linux.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_network_sniffing.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2022-12-18
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040
logsource:
  product: linux
  service: auditd
detection:
  selection_1:
    type: execve
    a0: tcpdump
    a1: -c
    a3|contains: -i
  selection_2:
    type: execve
    a0: tshark
    a1: -c
    a3: -i
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrator or user uses network sniffing tool for legitimate reasons.
level: low
license: DRL-1.1
related:
  - id: f4d3748a-65d1-4806-bd23-e25728081d01
    type: derived

What it detects

This rule flags Linux processes started via execve for tcpdump or tshark when the command line includes an interface selection flag (a3 contains "-i") and uses a packet count flag (-c). Network sniffing tools can be used by an attacker to passively collect data from network traffic or observe communications for further targeting. It relies on auditd telemetry capturing process execution arguments (executable and command-line fields) for Linux.

Known false positives

Legitimate administrator or user uses network sniffing tool for legitimate reasons.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.