macOS Process Creation: Detect tcpdump/tshark Network Sniffing Tool Usage

Identifies macOS execution of tcpdump or tshark, indicating potential network traffic sniffing activity.

FreeUnreviewedSigmainformationalv1

macos-process-creation-detect-tcpdump-tshark-network-sniffing-tool-usage-adc9bcc4

title: "macOS Process Creation: Detect tcpdump/tshark Network Sniffing Tool Usage"
id: ac65eeb8-a59f-432f-bc2c-d2885f49087f
status: test
description: This rule flags macOS process creation events where the executed binary path ends with tcpdump or tshark. These tools are commonly used to capture or inspect network traffic, enabling passive data collection or broader packet capture via network monitoring techniques. The detection relies on process creation telemetry that includes the process image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_network_sniffing.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-14
modified: 2022-11-26
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1040
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - /tcpdump
      - /tshark
  condition: selection
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: adc9bcc4-c39c-4f6b-a711-1884017bf043
    type: derived

What it detects

This rule flags macOS process creation events where the executed binary path ends with tcpdump or tshark. These tools are commonly used to capture or inspect network traffic, enabling passive data collection or broader packet capture via network monitoring techniques. The detection relies on process creation telemetry that includes the process image path.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.