macOS Network Sniffing Tool Execution via tcpdump or tshark

ATT&CK techniques

Cred Access → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1040Network Sniffing
Discovery
- T1040Network Sniffing
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation on macOS where the executable path ends with /tcpdump or /tshark. These tools are commonly used to capture and inspect network traffic, which enables passive collection of data in transit. The detection relies on process creation telemetry including the executed image path.

Reporting behind it

Related detections9 linkedT1040 — drag to rearrange

Suspicious Windows Native Pktmon Sniffer Abuse (via process_creation)

Suspicious Windows Traffic Capture Abuse (via process_creation)

Malicious TCP Session Hijacking via rshijack

PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)

Windows PktMon.exe Process Execution (pktmon.exe / PktMon.exe)

Windows Pcap Driver Installation via EID 4697 ServiceFileName

Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting

Windows netsh Trace Start Command Execution

Windows Network Tool Use for Possible Packet Sniffing (tshark/windump)

macOS Network Sniffing Tool Execution via tcpdump or tshark

Pivot detection · T1040 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-creation-detect-tcpdump-tshark-network-sniffing-tool-usage-adc9bcc4

title: macOS Network Sniffing Tool Execution via tcpdump or tshark
id: ac65eeb8-a59f-432f-bc2c-d2885f49087f
status: test
description: This rule identifies process creation on macOS where the executable path ends with /tcpdump or /tshark. These tools are commonly used to capture and inspect network traffic, which enables passive collection of data in transit. The detection relies on process creation telemetry including the executed image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_network_sniffing.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-14
modified: 2022-11-26
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1040
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - /tcpdump
      - /tshark
  condition: selection
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: adc9bcc4-c39c-4f6b-a711-1884017bf043
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL