LOL · Binary

Pktmon.exe

2 techniquesWindowsLOLBASGPL-3.0

Reconnaissance

DiscoveryWindows

Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop

Use use this a built in network sniffer on windows 10 to capture senstive traffic

pktmon.exe start --etw

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: Reconnaissance
MITRE: T1040
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_pktmon.yml
IOC: .etl files found on system
Refs: binar-x79.com/windows-10-secret-sniffer/
lolbas-project.github.io/lolbas/Binaries/Pktmon/

Reconnaissance

DiscoveryWindows

Select Desired ports for packet capture

Use Look for interesting traffic such as telent or FTP

pktmon.exe filter add -p 445

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: Reconnaissance
MITRE: T1040
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_pktmon.yml
IOC: .etl files found on system
Refs: binar-x79.com/windows-10-secret-sniffer/
lolbas-project.github.io/lolbas/Binaries/Pktmon/