Catalog LOLBAS

LOL · OtherMSBinary

Nmcap.exe

1 technique WindowsLOLBAS GPL-3.0

Reconnaissance

Discovery Windows

Start capture on all network adapters and save to specified .cap (circular) file. Optionally, one can add: - `/TerminateWhen /TimeAfter 30 seconds` to auto-terminate after a relative times (e.g. 30 seconds); - `/TerminateWhen /Time 04:52:00 AM 9/17/2025` to auto-terminate after a specific date/time; - `/TerminateWhen /KeyPress x` to terminate when a specific key is pressed.

Use Capture network traffic on windows to collect sensitive data.

nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}
Context
admin
Native
Reconnaissance
MITRE
T1040