Windows Pcap Driver Installation via Sys File Names (Security 4697)

title: Windows Pcap Driver Installation via Sys File Names (Security 4697)
id: 96109bdf-7503-43d2-87f8-47b18b606360
status: test
description: This rule identifies Windows driver installations by matching Security Event ID 4697 service file names that contain common packet capture driver indicators (e.g., pcap, npcap, npf, WinDivert, USBPcap). Attackers and legitimate tools may install these drivers to enable low-level packet capture and inspection. The detection relies on Windows Security auditing for 4697 and the availability of the installed service file name in the event data.
references:
  - https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_pcap_drivers.yml
author: Cian Heasley, Huntrule Team
date: 2020-06-10
modified: 2023-04-14
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1040
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains:
      - pcap
      - npcap
      - npf
      - nm3
      - ndiscap
      - nmnt
      - windivert
      - USBPcap
      - pktmon
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7b687634-ab20-11ea-bb37-0242ac130002
    type: derived