huntrule

Windows PktMon.exe Process Execution (pktmon.exe / PktMon.exe)

Alerts on Windows executions of PktMon.exe based on process creation image name and OriginalFileName.

FreeUnreviewedSigmamediumv1
title: Windows PktMon.exe Process Execution (pktmon.exe / PktMon.exe)
id: 62806703-7666-442d-9b26-84cc2924a5ab
status: test
description: This rule flags process creation events where an executable matching PktMon.exe is launched. Attackers may use packet-capture utilities like PktMon to support discovery, inspection, or credential-related activity. The detection relies on Windows process creation telemetry, matching the executable path suffix and the OriginalFileName field.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pktmon_execution.yml
author: frack113, Huntrule Team
date: 2022-03-17
modified: 2023-06-23
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \pktmon.exe
    - OriginalFileName: PktMon.exe
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: f956c7c1-0f60-4bc5-b7d7-b39ab3c08908
    type: derived

What it detects

This rule flags process creation events where an executable matching PktMon.exe is launched. Attackers may use packet-capture utilities like PktMon to support discovery, inspection, or credential-related activity. The detection relies on Windows process creation telemetry, matching the executable path suffix and the OriginalFileName field.

Known false positives

  • Legitimate use

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.