Pktmon.exe

Commands

1. ReconnaissanceAdministrator T1040

   use this a built in network sniffer on windows 10 to capture senstive traffic

   pktmon.exe start --etw

   Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop

   os: Windows 10 1809 and later, Windows 11

2. ReconnaissanceAdministrator T1040

   Look for interesting traffic such as telent or FTP

   pktmon.exe filter add -p 445

   Select Desired ports for packet capture

   os: Windows 10 1809 and later, Windows 11

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_pktmon.yml
• IOC.etl files found on system

Resources

• https://binar-x79.com/windows-10-secret-sniffer/