PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)
Alerts when PowerShell ScriptBlocks reference Start-NetEventSession, indicating potential network packet or event capture.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-05-12
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content that includes calls to the Start-NetEventSession cmdlet. Starting a network event session can be used to capture network traffic and related event data, which may help an attacker gather sensitive information during an operation. The detection relies on Script Block Logging telemetry capturing the script text executed by PowerShell.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
- github.comhttps://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md
- github.comhttps://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)
id: e0458161-69a8-4372-9486-b77b2680bbec
status: test
description: This rule flags PowerShell script block content that includes calls to the Start-NetEventSession cmdlet. Starting a network event session can be used to capture network traffic and related event data, which may help an attacker gather sensitive information during an operation. The detection relies on Script Block Logging telemetry capturing the script text executed by PowerShell.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
- https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md
- https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml
author: frack113, Huntrule Team
date: 2024-05-12
tags:
- attack.credential-access
- attack.discovery
- attack.t1040
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains: Start-NetEventSession
condition: selection
falsepositives:
- Legitimate network diagnostic scripts.
level: medium
license: DRL-1.1
related:
- id: da34e323-1e65-42db-83be-a6725ac2caa3
type: derived