UNC3886G1048 ↗
Has used the LOOKOVER sniffer to sniff TACACS+ authentication packets.1
tfMITRE ATT&CK technique
Network Sniffing T1040
- Tactics
- Credential Access, Discovery
- Platforms
- IaaS, Linux, macOS, Network Devices, Windows
- Version
- 1.7
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Oleg Kolesnikov, Securonix; Tiago Faria, 3CORESec; Austin Clark, @c2defense; Itamar Mizrahi, Cymptom; Eliraz Levi, Hunters
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
8
Threat groupsTop 21%
Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.17
Tools & malwareTop 20%
Tools & malware80th percentile · 80% of ATT&CK techniques have this many tools implementing them or fewer.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Network Sniffing MITRE reference T1040
Top 21%of all ATT&CK techniques for number of groups
8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Velvet AntG1047 ↗
Has used a custom tool, "VELVETTAP", to perform packet capture from compromised F5 BIG-IP devices.1
Salt TyphoonG1045 ↗
Has used a variety of tools and techniques to capture packet data between network interfaces.1
DarkVishnyaG0105 ↗
Used network sniffing to obtain login data. 1
KimsukyG0094 ↗
Has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.12
APT33G0064 ↗
Has used SniffPass to collect credentials by sniffing network traffic.1
All 8 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedPenguinC0056 ↗
During RedPenguin, UNC3886 used a passive backdoor to act as a libpcap-based packet sniffer.1
ArcaneDoorC0046 ↗
Included network packet capture and sniffing for data collection in victim environments.12
2015 Ukraine Electric Power AttackC0028 ↗
During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy’s network sniffer module to discover user credentials being sent over the network between the local LAN and the power grid’s industrial control systems. 1
All 3 campaigns for this technique
17 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
SPAWNCHIMERAS9024 ↗
Has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control. 12
CASTLETAPS1224 ↗
Has the ability to create a raw promiscuous socket to sniff network traffic.1
JumbledPathS1206 ↗
Has the ability to perform packet capture on remote devices via actor-defined jump-hosts.1
cd00rS1204 ↗
Can use the libpcap library to monitor captured packets for specifc sequences.1
J-magicS1203 ↗
Has a pcap listener function that can create an Extended Berkley Packet Filter (eBPF) on designated interfaces and ports.1
Line DancerS1186 ↗
Can create and exfiltrate packet captures from compromised environments.1
All 17 software entries for this technique · 6 newest in this preview
Offense vs defense T1040
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 3Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 3
first rule: 2019 Q3 · 3 of 3 campaigns plottedNetwork Sniffing detection strategy DET0314
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Network Sniffing Across Platforms
5 platforms
AN0875 · Windows
Detects suspicious execution of network monitoring tools (e.g., Wireshark, tshark, Microsoft Message Analyzer), driver loading indicative of promiscuous mode, or non-admin user privilege escalation to access NICs for capture.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Service CreationDC0060 | WinEventLog:System | EventCode=7045 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ToolNames | Adjust list of known sniffing tools based on environment and known administrator usage. |
| TimeWindow | Tune time of day or frequency of capture sessions to reduce false positives from authorized use. |
AN0876 · Linux
Correlates interface mode changes to promiscuous with execution of sniffing tools like tcpdump, tshark, or custom pcap libraries. Detects abnormal NIC configurations and unauthorized sniffing from non-root sessions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve, setifflags |
| Command ExecutionDC0064 | auditd:SYSCALL | promiscuous mode transitions (ioctl or ifconfig) |
| Network Traffic ContentDC0085 | networkconfig | interface flag PROMISC, netstat | ip link | ethtool |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InterfaceList | Limit analysis to external interfaces (e.g., eth0, wlan0) and exclude virtual adapters. |
| PromiscuousSessionThreshold | Raise alerts if interface remains in PROMISC longer than threshold duration. |
AN0877 · macOS
Detects enabling of interface sniffing via packet capture tools or AppleScript triggering tcpdump. Leverages Unified Logs and process lineage to identify suspicious use of pfctl, tcpdump, or libpcap libraries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | process_events where path like '%tcpdump%' |
| Command ExecutionDC0064 | fs:fsusage | access to BPF devices or interface IOCTLs |
| Network Traffic ContentDC0085 | macos:unifiedlog | eventMessage = 'promiscuous' |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedTools | Whitelist Apple-native tools used by IT admins and mobile device management (MDM). |
| UserContext | Prioritize detections from non-admin or low-privilege users performing packet captures. |
AN0878 · IaaS
Detects creation of traffic mirroring sessions (e.g., AWS VPC Traffic Mirroring, Azure vTAP) that redirect traffic from critical assets to other virtual instances, often followed by file creation or session establishment.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Service ModificationDC0069 | AWS:CloudTrail | CreateTrafficMirrorSession / ModifyTrafficMirrorTarget |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MirrorSourceList | Identify VMs or containers where mirror sessions are abnormal or unexpected. |
| TargetIAMRole | Monitor whether mirror target roles match administrative expectations. |
AN0879 · Network Devices
Detects execution of capture commands via CLI (monitor capture, debug packet, etc.) or unauthorized CLI access followed by logging configuration changes on Cisco/Juniper/Arista gear.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | networkdevice:syslog | admin login events |
| Command ExecutionDC0064 | networkdevice:syslog | exec command='monitor capture' |
| Network Traffic ContentDC0085 | networkdevice:syslog | config change (e.g., logging buffered, pcap buffers) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AdminSessionDuration | Tunable alerting threshold for interactive CLI sessions. |
| CaptureCommandList | Define set of known capture/debug commands per vendor to flag unexpected usage. |
1 analytic
Adversaries may use a variety of tools to gain visibility on the current status of things on the network: which processes are listening on which ports, which services are running on other hosts, etc. This analytic looks for the names of the most common network sniffing tools. While this may be noisy on networks where sysadmins are using any of these tools on a regular basis, in most networks their use is noteworthy.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | parent_exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process:Create sniffer_processes = filter processes where ( exe = "tshark.exe" OR exe = "windump.exe" OR (exe = "logman.exe" AND parent_exe exists AND parent_exe!="C:\Program Files\Windows Event Reporting\Core\EventReporting.AgentService.exe") OR exe = "tcpdump.exe" OR exe = "wprui.exe" OR exe = "wpr.exe" ) output sniffer_processes
look for common network traffic sniffing apps being run
(index=__your_sysmon_index__ EventCode=1) (Image="*tshark.exe" OR Image="*windump.exe" OR (Image="*logman.exe" AND ParentImage!="?" AND ParentImage!="C:\\Program Files\\Windows Event Reporting\\Core\\EventReporting.AgentService.exe") OR Image="*tcpdump.exe" OR Image="*wprui.exe" OR Image="*wpr.exe")
look for common network traffic sniffing apps being run
norm_id=WindowsSysmon event_id=1 (image="*\tshark.exe" OR image="*\windump.exe" OR (image="*\logman.exe" -parent_image="?" -parent_image="C:\Program Files\Windows Event Reporting\Core\EventReporting.AgentService.exe") OR image="*\tcpdump.exe" OR image="*\wprui.exe" OR image="*\wpr.exe")
Ensure that all wired and/or wireless traffic is encrypted appropriately. Use best practices for authentication protocols, such as Kerberos, and ensure web traffic that may contain credentials is protected by SSL/TLS.
Use multi-factor authentication wherever possible.
Network SegmentationM1030
Deny direct access of broadcasts and multicast sniffing, and prevent attacks such as Name Resolution Poisoning and SMB Relay
In cloud environments, ensure that users are not granted permissions to create or modify traffic mirrors unless this is explicitly required.
Tests16Executorsbash 8 · cmd 4 · sh 3 · PowerShell 1Need elevation16 of 16Have prerequisites12Have cleanup12Platformslinux, macos, windows
Tests from Atomic Red Team (MIT licence) · technique definition