huntrule

Linux: Detect execution of tcpdump or tshark with interface (-i) capture option

Alerts on tcpdump or tshark executions on Linux where an interface flag is present, consistent with network sniffing.

FreeReviewedSigma · Low · v3
Product
linux
Service
auditd
Author
Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-21
Updated
2026-07-31
AnalysisDetection
title: "Linux: Detect execution of tcpdump or tshark with interface (-i) capture option"
id: 5036dedf-f8a5-4caf-99f9-90f6fbf94ce8
status: test
description: This rule flags processes where tcpdump or tshark are executed with command-line arguments indicating packet capture on a specified network interface (-i) and limiting captures (-c). This behavior matters because network sniffing can be used to passively collect information in transit or increase visibility into network traffic. Telemetry relies on Linux auditd records that capture execve command-line details for these tools.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_network_sniffing.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2022-12-18
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040
logsource:
  product: linux
  service: auditd
detection:
  selection_1:
    type: execve
    a0: tcpdump
    a1: -c
    a3|contains: -i
  selection_2:
    type: execve
    a0: tshark
    a1: -c
    a3: -i
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrator or user uses network sniffing tool for legitimate reasons.
level: low
license: DRL-1.1
related:
  - id: f4d3748a-65d1-4806-bd23-e25728081d01
    type: derived