Windows Network Tool Use for Possible Packet Sniffing (tshark/windump)

Alerts on Windows executions of tshark or windump that indicate potential passive network traffic capture.

FreeUnreviewedSigmamediumv1

windows-network-tool-use-for-possible-packet-sniffing-tshark-windump-ba1f7802

title: Windows Network Tool Use for Possible Packet Sniffing (tshark/windump)
id: bea2647b-6890-4822-ba7b-389f1331064a
status: test
description: This rule flags process creations on Windows that invoke packet-sniffing network tools, specifically tshark.exe with an interface selection flag and windump.exe. Such activity is important because it can be used to passively capture network traffic for reconnaissance, credential exposure, or data collection. It relies on process creation telemetry including the executable name and command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_network_sniffing.yml
author: Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-21
modified: 2023-02-20
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_tshark:
    Image|endswith: \tshark.exe
    CommandLine|contains: -i
  selection_windump:
    Image|endswith: \windump.exe
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration activity to troubleshoot network issues
level: medium
license: DRL-1.1
related:
  - id: ba1f7802-adc7-48b4-9ecb-81e227fddfd5
    type: derived

What it detects

This rule flags process creations on Windows that invoke packet-sniffing network tools, specifically tshark.exe with an interface selection flag and windump.exe. Such activity is important because it can be used to passively capture network traffic for reconnaissance, credential exposure, or data collection. It relies on process creation telemetry including the executable name and command-line arguments.

Known false positives

Legitimate administration activity to troubleshoot network issues

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.