PowerShell ScriptBlock Start-NetEventSession Packet/Event Capture Activity (Windows)

Alerts when PowerShell ScriptBlocks reference Start-NetEventSession, indicating potential network packet or event capture.

FreeUnreviewedSigmamediumv1

powershell-scriptblock-start-neteventsession-packet-event-capture-activity-windo-da34e323

title: PowerShell ScriptBlock Start-NetEventSession Packet/Event Capture Activity (Windows)
id: e0458161-69a8-4372-9486-b77b2680bbec
status: test
description: This rule flags PowerShell ScriptBlock execution that contains the Start-NetEventSession cmdlet. Attackers can use event and packet capture capabilities to observe network activity and potentially collect sensitive information during an operation. The detection relies on Script Block Logging telemetry that records the PowerShell ScriptBlock content being executed.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
  - https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md
  - https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml
author: frack113, Huntrule Team
date: 2024-05-12
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Start-NetEventSession
  condition: selection
falsepositives:
  - Legitimate network diagnostic scripts.
level: medium
license: DRL-1.1
related:
  - id: da34e323-1e65-42db-83be-a6725ac2caa3
    type: derived

What it detects

This rule flags PowerShell ScriptBlock execution that contains the Start-NetEventSession cmdlet. Attackers can use event and packet capture capabilities to observe network activity and potentially collect sensitive information during an operation. The detection relies on Script Block Logging telemetry that records the PowerShell ScriptBlock content being executed.

Known false positives

Legitimate network diagnostic scripts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.