Windows Network Tool Use for Possible Packet Sniffing (tshark/windump)
Alerts on Windows executions of tshark or windump that indicate potential passive network traffic capture.
- Product
- windows
- Category
- process_creation
- Author
- Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-10-21
- Updated
- 2026-07-30
ATT&CK techniques
Cred Access → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creations on Windows that invoke packet-sniffing network tools, specifically tshark.exe with an interface selection flag and windump.exe. Such activity is important because it can be used to passively capture network traffic for reconnaissance, credential exposure, or data collection. It relies on process creation telemetry including the executable name and command-line arguments.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Network Tool Use for Possible Packet Sniffing (tshark/windump)
id: bea2647b-6890-4822-ba7b-389f1331064a
status: test
description: This rule flags process creations on Windows that invoke packet-sniffing network tools, specifically tshark.exe with an interface selection flag and windump.exe. Such activity is important because it can be used to passively capture network traffic for reconnaissance, credential exposure, or data collection. It relies on process creation telemetry including the executable name and command-line arguments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_network_sniffing.yml
author: Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-21
modified: 2023-02-20
tags:
- attack.credential-access
- attack.discovery
- attack.t1040
logsource:
category: process_creation
product: windows
detection:
selection_tshark:
Image|endswith: \tshark.exe
CommandLine|contains: -i
selection_windump:
Image|endswith: \windump.exe
condition: 1 of selection_*
falsepositives:
- Legitimate administration activity to troubleshoot network issues
level: medium
license: DRL-1.1
related:
- id: ba1f7802-adc7-48b4-9ecb-81e227fddfd5
type: derived