Windows Pcap Driver Installation via EID 4697 ServiceFileName

ATT&CK techniques

Cred Access → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1040Network Sniffing
Discovery
- T1040Network Sniffing
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows driver installation activity by matching Security event ID 4697 service file names against common packet-capture driver components. Attackers and monitoring tools may install these drivers to enable low-level network visibility, which can also support credential access and discovery workflows. Detection relies on Windows Security audit telemetry for EID 4697 and the ServiceFileName field.

Reporting behind it

Related detections9 linkedT1040 — drag to rearrange

Suspicious Windows Native Pktmon Sniffer Abuse (via process_creation)

Suspicious Windows Traffic Capture Abuse (via process_creation)

Malicious TCP Session Hijacking via rshijack

PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)

Windows PktMon.exe Process Execution (pktmon.exe / PktMon.exe)

macOS Network Sniffing Tool Execution via tcpdump or tshark

Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting

Windows netsh Trace Start Command Execution

Windows Network Tool Use for Possible Packet Sniffing (tshark/windump)

Windows Pcap Driver Installation via EID 4697 ServiceFileName

Pivot detection · T1040 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-pcap-driver-installation-via-sys-file-names-security-4697-7b687634

title: Windows Pcap Driver Installation via EID 4697 ServiceFileName
id: 96109bdf-7503-43d2-87f8-47b18b606360
status: test
description: This rule identifies Windows driver installation activity by matching Security event ID 4697 service file names against common packet-capture driver components. Attackers and monitoring tools may install these drivers to enable low-level network visibility, which can also support credential access and discovery workflows. Detection relies on Windows Security audit telemetry for EID 4697 and the ServiceFileName field.
references:
  - https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_pcap_drivers.yml
author: Cian Heasley, Huntrule Team
date: 2020-06-10
modified: 2023-04-14
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1040
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains:
      - pcap
      - npcap
      - npf
      - nm3
      - ndiscap
      - nmnt
      - windivert
      - USBPcap
      - pktmon
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7b687634-ab20-11ea-bb37-0242ac130002
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL