Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment.
In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.[1][2][3] Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic.[4][5] The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.[4]
On network devices, adversaries may perform network captures using Network Device CLI commands such as monitor capture.[6][7]
Top 21%of all ATT&CK techniques for number of groups
8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
17 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control. 12
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Network Sniffing Across Platforms
Enterprise
5 platforms
AN0875 · Windows
Detects suspicious execution of network monitoring tools (e.g., Wireshark, tshark, Microsoft Message Analyzer), driver loading indicative of promiscuous mode, or non-admin user privilege escalation to access NICs for capture.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ToolNames
Adjust list of known sniffing tools based on environment and known administrator usage.
TimeWindow
Tune time of day or frequency of capture sessions to reduce false positives from authorized use.
AN0876 · Linux
Correlates interface mode changes to promiscuous with execution of sniffing tools like tcpdump, tshark, or custom pcap libraries. Detects abnormal NIC configurations and unauthorized sniffing from non-root sessions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
interface flag PROMISC, netstat | ip link | ethtool
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
InterfaceList
Limit analysis to external interfaces (e.g., eth0, wlan0) and exclude virtual adapters.
PromiscuousSessionThreshold
Raise alerts if interface remains in PROMISC longer than threshold duration.
AN0877 · macOS
Detects enabling of interface sniffing via packet capture tools or AppleScript triggering tcpdump. Leverages Unified Logs and process lineage to identify suspicious use of pfctl, tcpdump, or libpcap libraries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
AllowedTools
Whitelist Apple-native tools used by IT admins and mobile device management (MDM).
UserContext
Prioritize detections from non-admin or low-privilege users performing packet captures.
AN0878 · IaaS
Detects creation of traffic mirroring sessions (e.g., AWS VPC Traffic Mirroring, Azure vTAP) that redirect traffic from critical assets to other virtual instances, often followed by file creation or session establishment.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
MirrorSourceList
Identify VMs or containers where mirror sessions are abnormal or unexpected.
TargetIAMRole
Monitor whether mirror target roles match administrative expectations.
AN0879 · Network Devices
Detects execution of capture commands via CLI (monitor capture, debug packet, etc.) or unauthorized CLI access followed by logging configuration changes on Cisco/Juniper/Arista gear.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
AdminSessionDuration
Tunable alerting threshold for interactive CLI sessions.
CaptureCommandList
Define set of known capture/debug commands per vendor to flag unexpected usage.
1 analytic
Adversaries may use a variety of tools to gain visibility on the current status of things on the network: which processes are listening on which ports, which services are running on other hosts, etc. This analytic looks for the names of the most common network sniffing tools. While this may be noisy on networks where sysadmins are using any of these tools on a regular basis, in most networks their use is noteworthy.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process:Create
sniffer_processes = filter processes where (
exe = "tshark.exe" OR
exe = "windump.exe" OR
(exe = "logman.exe" AND parent_exe exists AND parent_exe!="C:\Program Files\Windows Event Reporting\Core\EventReporting.AgentService.exe") OR
exe = "tcpdump.exe" OR
exe = "wprui.exe" OR
exe = "wpr.exe" )
output sniffer_processes
look for common network traffic sniffing apps being run
(index=__your_sysmon_index__ EventCode=1) (Image="*tshark.exe" OR Image="*windump.exe" OR (Image="*logman.exe" AND ParentImage!="?" AND ParentImage!="C:\\Program Files\\Windows Event Reporting\\Core\\EventReporting.AgentService.exe") OR Image="*tcpdump.exe" OR Image="*wprui.exe" OR Image="*wpr.exe")
look for common network traffic sniffing apps being run
norm_id=WindowsSysmon event_id=1 (image="*\tshark.exe" OR image="*\windump.exe" OR (image="*\logman.exe" -parent_image="?" -parent_image="C:\Program Files\Windows Event Reporting\Core\EventReporting.AgentService.exe") OR image="*\tcpdump.exe" OR image="*\wprui.exe" OR image="*\wpr.exe")
Ensure that all wired and/or wireless traffic is encrypted appropriately. Use best practices for authentication protocols, such as Kerberos, and ensure web traffic that may contain credentials is protected by SSL/TLS.
In cloud environments, ensure that users are not granted permissions to create or modify traffic mirrors unless this is explicitly required.
Tests16Executorsbash 8 · command_prompt 4 · sh 3 · powershell 1Need elevation16 of 16Have prerequisites12Have cleanup12Platformslinux, macos, windows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Packet Capture Linux using tshark or tcpdump
linux
bash
Required
1
—
Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.
Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.
Inputs
Name
Description
Type
Default Value
interface
Specify interface to perform PCAP on.
string
ens33
Attack Commandsrun with bashelevation required (root or admin)
Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.
Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.
Inputs
Name
Description
Type
Default Value
interface
Specify interface to perform PCAP on.
string
em0
Attack Commandsrun with shelevation required (root or admin)
Perform a PCAP on macOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed.
Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface en0A.
Inputs
Name
Description
Type
Default Value
interface
Specify interface to perform PCAP on.
string
en0A
Attack Commandsrun with bashelevation required (root or admin)
Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
installed.
Upon successful execution, tshark will execute and capture 5 packets on interface "Ethernet".
Select Desired ports for packet capture
https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
Attack Commandsrun with command_promptelevation required (root or admin)
pktmon.exe filter add -p 445
Cleanup Commands
pktmon filter remove
GUID855fb8b4-b8ab-4785-ae77-09f5df7bff55
08
Packet Capture macOS using /dev/bpfN with sudo
macos
bash
Required
1
Yes
Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.
Inputs
Name
Description
Type
Default Value
ifname
Specify interface to perform PCAP on.
string
en0
csource_path
Path to C program source
string
PathToAtomicsFolder/T1040/src/macos_pcapdemo.c
program_path
Path to compiled C program
string
/tmp/t1040_macos_pcapdemo
Attack Commandsrun with bashelevation required (root or admin)
sudo #{program_path} -i #{ifname} -t 3
Cleanup Commands
rm -f #{program_path}
Dependenciesrun with bash
Description
compile C program
Check Prereq Commands
exit 1
Get Prereq Commands
cc #{csource_path} -o #{program_path}
GUIDe6fe5095-545d-4c8b-a0ae-e863914be3aa
09
Filtered Packet Capture macOS using /dev/bpfN with sudo
macos
bash
Required
1
Yes
Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.
Inputs
Name
Description
Type
Default Value
ifname
Specify interface to perform PCAP on.
string
en0
csource_path
Path to C program source
string
PathToAtomicsFolder/T1040/src/macos_pcapdemo.c
program_path
Path to compiled C program
string
/tmp/t1040_macos_pcapdemo
Attack Commandsrun with bashelevation required (root or admin)
sudo #{program_path} -f -i #{ifname} -t 3
Cleanup Commands
rm -f #{program_path}
Dependenciesrun with bash
Description
compile C program
Check Prereq Commands
exit 1
Get Prereq Commands
cc #{csource_path} -o #{program_path}
GUIDe2480aee-23f3-4f34-80ce-de221e27cd19
10
Packet Capture FreeBSD using /dev/bpfN with sudo
linux
sh
Required
1
Yes
Opens a /dev/bpf file (O_RDONLY) and captures packets for a few seconds.
Inputs
Name
Description
Type
Default Value
ifname
Specify interface to perform PCAP on.
string
em0
csource_path
Path to C program source
string
PathToAtomicsFolder/T1040/src/freebsd_pcapdemo.c
program_path
Path to compiled C program
string
/tmp/t1040_freebsd_pcapdemo
Attack Commandsrun with shelevation required (root or admin)
sudo #{program_path} -i #{ifname} -t 3
Cleanup Commands
rm -f #{program_path}
Dependenciesrun with sh
Description
compile C program
Check Prereq Commands
exit 1
Get Prereq Commands
cc #{csource_path} -o #{program_path}
GUIDe2028771-1bfb-48f5-b5e6-e50ee0942a14
11
Filtered Packet Capture FreeBSD using /dev/bpfN with sudo
linux
sh
Required
1
Yes
Opens a /dev/bpf file (O_RDONLY), sets BPF filter for 'udp' and captures packets for a few seconds.
Inputs
Name
Description
Type
Default Value
ifname
Specify interface to perform PCAP on.
string
em0
csource_path
Path to C program source
string
PathToAtomicsFolder/T1040/src/freebsd_pcapdemo.c
program_path
Path to compiled C program
string
/tmp/t1040_freebsd_pcapdemo
Attack Commandsrun with shelevation required (root or admin)
sudo #{program_path} -f -i #{ifname} -t 3
Cleanup Commands
rm -f #{program_path}
Dependenciesrun with sh
Description
compile C program
Check Prereq Commands
exit 1
Get Prereq Commands
cc #{csource_path} -o #{program_path}
GUIDa3a0d4c9-c068-4563-a08d-583bd05b884c
12
Packet Capture Linux socket AF_PACKET,SOCK_RAW with sudo
linux
bash
Required
1
Yes
Captures packets with domain=AF_PACKET, type=SOCK_RAW for a few seconds.
Inputs
Name
Description
Type
Default Value
csource_path
Path to C program source
string
PathToAtomicsFolder/T1040/src/linux_pcapdemo.c
program_path
Path to compiled C program
string
/tmp/t1040_linux_pcapdemo
Attack Commandsrun with bashelevation required (root or admin)
sudo #{program_path} -a -t 3
Cleanup Commands
rm -f #{program_path}
Dependenciesrun with bash
Description
compile C program
Check Prereq Commands
if [ -f "#{program_path}" ]; then exit 0; else exit 1; fi
Get Prereq Commands
cc #{csource_path} -o #{program_path}
GUID10c710c9-9104-4d5f-8829-5b65391e2a29
13
Packet Capture Linux socket AF_INET,SOCK_RAW,TCP with sudo
linux
bash
Required
1
Yes
Captures packets with domain=AF_INET,type=SOCK_RAW,protocol=TCP for a few seconds.
Inputs
Name
Description
Type
Default Value
csource_path
Path to C program source
string
PathToAtomicsFolder/T1040/src/linux_pcapdemo.c
program_path
Path to compiled C program
string
/tmp/t1040_linux_pcapdemo
Attack Commandsrun with bashelevation required (root or admin)
sudo #{program_path} -4 -p 6 -t 3
Cleanup Commands
rm -f #{program_path}
Dependenciesrun with bash
Description
compile C program
Check Prereq Commands
if [ -f "#{program_path}" ]; then exit 0; else exit 1; fi
Get Prereq Commands
cc #{csource_path} -o #{program_path}
GUID7a0895f0-84c1-4adf-8491-a21510b1d4c1
14
Packet Capture Linux socket AF_INET,SOCK_PACKET,UDP with sudo
linux
bash
Required
1
Yes
Captures packets with domain=AF_INET,type=SOCK_PACKET,protocol=UDP for a few seconds.
SOCK_PACKET is "obsolete" according to the man page, but still works on Ubuntu 20.04
Inputs
Name
Description
Type
Default Value
csource_path
Path to C program source
string
PathToAtomicsFolder/T1040/src/linux_pcapdemo.c
program_path
Path to compiled C program
string
/tmp/t1040_linux_pcapdemo
Attack Commandsrun with bashelevation required (root or admin)
sudo #{program_path} -4 -P -p 17 -t 3
Cleanup Commands
rm -f #{program_path}
Dependenciesrun with bash
Description
compile C program
Check Prereq Commands
if [ -f "#{program_path}" ]; then exit 0; else exit 1; fi
Get Prereq Commands
cc #{csource_path} -o #{program_path}
GUID515575ab-d213-42b1-aa64-ef6a2dd4641b
15
Packet Capture Linux socket AF_PACKET,SOCK_RAW with BPF filter for UDP with sudo
linux
bash
Required
1
Yes
Captures packets with domain=AF_PACKET,type=SOCK_RAW for a few seconds.
Sets a BPF filter on the socket to filter for UDP traffic.
Inputs
Name
Description
Type
Default Value
csource_path
Path to C program source
string
PathToAtomicsFolder/T1040/src/linux_pcapdemo.c
program_path
Path to compiled C program
string
/tmp/t1040_linux_pcapdemo
Attack Commandsrun with bashelevation required (root or admin)
sudo #{program_path} -a -f -t 3
Cleanup Commands
rm -f #{program_path}
Dependenciesrun with bash
Description
compile C program
Check Prereq Commands
if [ -f "#{program_path}" ]; then exit 0; else exit 1; fi
Get Prereq Commands
cc #{csource_path} -o #{program_path}
GUIDb1cbdf8b-6078-48f5-a890-11ea19d7f8e9
16
PowerShell Network Sniffing
windows
powershell
Required
—
Yes
PowerShell Built-in Cmdlets to capture network traffic.
https://learn.microsoft.com/en-us/powershell/module/neteventpacketcapture/new-neteventsession?view=windowsserver2022-ps
Attack Commandsrun with powershellelevation required (root or admin)
This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...)
The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities. (...)