Suspicious Windows Pcap Drivers (via security)

title: Suspicious Windows Pcap Drivers (via security)
id: f3bcbca1-c717-508b-a221-311e76ed1e01
status: stable
description: This rule detects Windows Pcap driver installation based on a list of linked .sys files.
references:
    - https://attack.mitre.org/techniques/T1040/
    - https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more
author: Huntrule Team
date: 2026-04-11
tags:
    - attack.discovery
    - attack.credential-access
    - attack.t1040
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains:
            - 'pcap'
            - 'npcap'
            - 'npf'
            - 'nm3'
            - 'ndiscap'
            - 'nmnt'
            - 'windivert'
            - 'USBPcap'
            - 'pktmon'
    condition: selection
falsepositives:
    - Unknown
level: medium