Techniques › T1040
T1040 Network Sniffing
credential access · discovery — IaaS, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
9
Sigma rules tagged attack.t1040
2
KEV CVEs mapped here
<p>Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.</p><p>Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.</p><p>Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment.</p><p>In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic. The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.</p><p>On network devices, adversaries may perform network captures using Network Device CLI commands such as
monitor capture.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2021-32030 | ASUS Routers | primary impact | Mapped | 2025-06-02 |
| CVE-2022-1040 | Sophos Firewall | secondary impact | Mapped | 2022-03-31 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0314 Detection Strategy for Network Sniffing Across Platforms v1.0
AN0875 WindowsDetects suspicious execution of network monitoring tools (e.g., Wireshark, tshark, Microsoft Message Analyzer), driver loading indicative of promiscuous mode, or non-admin user privilege escalation to access NICs for capture.Tunable:
ToolNamesTimeWindowAN0876 LinuxCorrelates interface mode changes to promiscuous with execution of sniffing tools like tcpdump, tshark, or custom pcap libraries. Detects abnormal NIC configurations and unauthorized sniffing from non-root sessions.Tunable:InterfaceListPromiscuousSessionThresholdAN0877 macOSDetects enabling of interface sniffing via packet capture tools or AppleScript triggeringtcpdump. Leverages Unified Logs and process lineage to identify suspicious use ofpfctl,tcpdump, orlibpcaplibraries.Tunable:AllowedToolsUserContextAN0878 IaaSDetects creation of traffic mirroring sessions (e.g., AWS VPC Traffic Mirroring, Azure vTAP) that redirect traffic from critical assets to other virtual instances, often followed by file creation or session establishment.AWS:CloudTrailCreateTrafficMirrorSession / ModifyTrafficMirrorTarget→ DC0069 Cloud Service ModificationTunable:MirrorSourceListTargetIAMRoleAN0879 Network DevicesDetects execution of capture commands via CLI (monitor capture,debug packet, etc.) or unauthorized CLI access followed by logging configuration changes on Cisco/Juniper/Arista gear.networkdevice:syslogconfig change (e.g., logging buffered, pcap buffers)→ DC0085 Network Traffic ContentTunable:AdminSessionDurationCaptureCommandList
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1040
Author: Andreas Hunkeler (@Karneades), oscd.community
· 2020-04-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · 42b1a5b8-353f-4f10-b256-39de4467faff
Detect the harvesting of wifi credentials using netsh.exe
Author: Cian Heasley
· 2020-06-10 (modified 2023-04-14) · logsource: product=windows service=security · 7b687634-ab20-11ea-bb37-0242ac130002
Detects Windows Pcap driver installation based on a list of associated .sys files.
Author: Alejandro Ortuno, oscd.community
· 2020-10-14 (modified 2022-11-26) · logsource: product=macos category=process_creation · adc9bcc4-c39c-4f6b-a711-1884017bf043
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Author: Austin Clark
· 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · b9e1f193-d236-4451-aaae-2f3d2102120d
Show when a monitor or a span/rspan is setup or modified
Author: Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-10-21 (modified 2023-02-20) · logsource: product=windows category=process_creation · ba1f7802-adc7-48b4-9ecb-81e227fddfd5
Detects potential network sniffing via use of network tools such as "tshark", "windump".
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Author: Kutepov Anton, oscd.community
· 2019-10-24 (modified 2023-02-13) · logsource: product=windows category=process_creation · d3c3861d-c504-4c77-ba55-224ba82d0118
Detects the execution of netsh with the "trace" flag in order to start a network capture
Author: frack113
· 2024-05-12 · logsource: product=windows category=ps_script · da34e323-1e65-42db-83be-a6725ac2caa3
Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session.
Adversaries may attempt to capture network to gather information over the course of an operation.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.
Author: Timur Zinniatullin, oscd.community
· 2019-10-21 (modified 2022-12-18) · logsource: product=linux service=auditd · f4d3748a-65d1-4806-bd23-e25728081d01
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Author: frack113
· 2022-03-17 (modified 2023-06-23) · logsource: product=windows category=process_creation · f956c7c1-0f60-4bc5-b7d7-b39ab3c08908
Detects execution of PktMon, a tool that captures network packets.