Cross-source coverage

T1040 / ATT&CK

Network Sniffing

34 rules · 32 families across 8 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.

Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment.

In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic. The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.

On network devices, adversaries may perform network captures using Network Device CLI commands such as monitor capture.

Platforms
IaaS · Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Systemauditd:SYSCALLnetworkconfig macos:unifiedlogmacos:osqueryfs:fsusageAWS:CloudTrailnetworkdevice:syslog

How MITRE says to detect it DET0314

Detection Strategy for Network Sniffing Across Platforms

Windows Analytic 0875

Detects suspicious execution of network monitoring tools (e.g., Wireshark, tshark, Microsoft Message Analyzer), driver loading indicative of promiscuous mode, or non-admin user privilege escalation to access NICs for capture.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:System EventCode=7045

Linux Analytic 0876

Correlates interface mode changes to promiscuous with execution of sniffing tools like tcpdump, tshark, or custom pcap libraries. Detects abnormal NIC configurations and unauthorized sniffing from non-root sessions.

  • auditd:SYSCALL execve, setifflags
  • auditd:SYSCALL promiscuous mode transitions (ioctl or ifconfig)
  • networkconfig interface flag PROMISC, netstat | ip link | ethtool

macOS Analytic 0877

Detects enabling of interface sniffing via packet capture tools or AppleScript triggering `tcpdump`. Leverages Unified Logs and process lineage to identify suspicious use of `pfctl`, `tcpdump`, or `libpcap` libraries.

  • macos:unifiedlog eventMessage = 'promiscuous'
  • macos:osquery process_events where path like '%tcpdump%'
  • fs:fsusage access to BPF devices or interface IOCTLs

IaaS Analytic 0878

Detects creation of traffic mirroring sessions (e.g., AWS VPC Traffic Mirroring, Azure vTAP) that redirect traffic from critical assets to other virtual instances, often followed by file creation or session establishment.

  • AWS:CloudTrail CreateTrafficMirrorSession / ModifyTrafficMirrorTarget

Network Devices Analytic 0879

Detects execution of capture commands via CLI (`monitor capture`, `debug packet`, etc.) or unauthorized CLI access followed by logging configuration changes on Cisco/Juniper/Arista gear.

  • networkdevice:syslog admin login events
  • networkdevice:syslog exec command='monitor capture'
  • networkdevice:syslog config change (e.g., logging buffered, pcap buffers)

View on attack.mitre.org ↗

socfortress/Wazuh-Rules

11 rules · 9 families
Detection Severity Format
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. 2 variants High Wazuh XML
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. 2 variants High Wazuh XML
Sysmon - Event 1: Process creation · Netsh Trace Start (T1040) High Wazuh XML
Sysmon - Event 1: Process creation · Pktmon Capture Start (T1040) High Wazuh XML
Sysmon - Event 1: Process creation · Pktmon Filter Add (T1040) High Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Network Sniffing (T1040) High Wazuh XML
Sysmon - Event 1: Process creation · Tshark Packet Capture (T1040) High Wazuh XML
Execution of tcpdump detected — potential network sniffing (T1040) Medium Wazuh XML
Execution of tshark detected — potential network sniffing (T1040) Medium Wazuh XML
Sysmon - Event 1: Process creation · Network Sniffing (T1040) 2 variants Low Wazuh XML

+ 1 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

SigmaHQ/sigma

9 rules
Detection Severity Format
Cisco Sniffing Medium Sigma
Harvesting Of Wifi Credentials Via Netsh.EXE Medium Sigma
New Network Trace Capture Started Via Netsh.EXE Medium Sigma
PktMon.EXE Execution Medium Sigma
Potential Network Sniffing Activity Using Network Tools Medium Sigma
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock Medium Sigma
Windows Pcap Drivers Medium Sigma
Network Sniffing - Linux Low Sigma
Network Sniffing - MacOs Informational Sigma

elastic/detection-rules

4 rules
Detection Severity Format
AWS EC2 Full Network Packet Capture Detected Medium Elastic TOML
Azure VNet Full Network Packet Capture Enabled Medium Elastic TOML
Suspicious Network Tool Launch Detected via Defend for Containers Low Elastic TOML
Suspicious Network Tool Launched Inside A Container Low Elastic TOML

panther-labs/panther-analysis

3 rules
Detection Severity Format
AWS EC2 Traffic Mirroring Medium Panther Python
Azure Network Packet Capture Enabled Medium Panther Python
Kubernetes Ingress Created Without TLS Medium Panther Python

splunk/security_content

3 rules
Detection Severity Format
Cisco ASA - Packet Capture Activity Undefined SPL
Cisco SNMP Community String Configuration Changes Undefined SPL
Windows Network Sniffing Tool Executed Undefined SPL

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
MITRE ATT&CK Mapping Undefined KQL
Windows Network Sniffing Undefined KQL

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Zoom E2E Encryption Disabled Medium KQL

Wazuh Core Ruleset

1 rule
Detection Severity Format
Interface entered in promiscuous(sniffing) mode. Medium Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.