Potential Network Sniffing Activity Using Network Tools (ba1f7802-adc7-48b4-9ecb-81e227fddfd5)
Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Network Sniffing - T1040 (3257eb21-f9a7-4430-8de1-d8b6e288f529) | Attack Pattern | Potential Network Sniffing Activity Using Network Tools (ba1f7802-adc7-48b4-9ecb-81e227fddfd5) | Sigma-Rules | 1 |