T1040 — Network Sniffing

Tactics: Credential Access, Discovery · Platforms: IaaS, Linux, macOS, Network Devices, Windows

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An…

Sigma detection rules (5)

T1040 Network Sniffing

title: T1040 Network Sniffing
id: a9f41e61-5b5f-445f-9e84-81cfa97a8ff2
description: 'Detection Strategy for Network Sniffing Across Platforms. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ToolNames, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1040
author: Shahrukh Khan
date: 2026-01-06
license: MIT
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040

logsource:
  product: windows
  service: system

detection:
  selection:
    EventID: '4688'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1040 Network Sniffing

title: T1040 Network Sniffing
id: fd0d771f-9016-406a-abc5-62b10972a43a
description: 'Detection Strategy for Network Sniffing Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this technique''s behavior; see logsource below.) Drops the imprecise ioctl(SIOCSIFFLAGS) selector, since auditd''s a1 only captures the ioctl request code and not the ifreq flags value and can never confirm IFF_PROMISC was actually set, and instead matches only known packet-capture/raw-socket sniffing tool execution. Tune using: InterfaceList, PromiscuousSessionThreshold.'
references:
  - https://attack.mitre.org/techniques/T1040
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040

logsource:
  category: process_creation
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/tcpdump'
      - '/tshark'
      - '/wireshark'
      - '/dumpcap'
      - '/ettercap'
      - '/ngrep'
      - '/tcpflow'

  condition: selection_tool

falsepositives:
  - 'Legitimate network troubleshooting by administrators using tcpdump/tshark/dumpcap; dumpcap in particular is spawned as a helper process by Wireshark itself, so expect a paired dumpcap+wireshark event on normal interactive captures.'

level: medium

T1040 Network Sniffing

title: T1040 Network Sniffing
id: a24812ce-ecb5-437f-9b16-257af9dd9662
description: 'Detection Strategy for Network Sniffing Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedTools, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1040
author: Shahrukh Khan
date: 2026-03-05
license: MIT
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/tcpdump'
  filter_allowed:
    CommandLine|contains: 'lo0'
  condition: selection and not filter_allowed

falsepositives:
  - Network engineers or support staff legitimately capturing traffic for troubleshooting.

level: high

T1040 Network Sniffing

title: T1040 Network Sniffing
id: 11a08578-7b55-40dc-bf9c-8938839f4fcd
description: 'Detection Strategy for Network Sniffing Across Platforms. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MirrorSourceList, TargetIAMRole.'
references:
  - https://attack.mitre.org/techniques/T1040
author: Shahrukh Khan
date: 2026-06-25
license: MIT
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_mirror:
    eventSource: 'ec2.amazonaws.com'
    eventName:
      - 'CreateTrafficMirrorSession'
      - 'CreateTrafficMirrorTarget'
      - 'ModifyTrafficMirrorSession'
  selection_role_pass:
    eventSource: 'iam.amazonaws.com'
    eventName: 'PassRole'
    requestParameters.roleName|contains:
      - 'flow'
      - 'mirror'
      - 'capture'

  condition: 1 of selection_*

falsepositives:
  - Network engineering teams provisioning legitimate packet capture or IDS mirroring infrastructure will trigger this, so confirm against change management records.

level: high

T1040 Network Sniffing

title: T1040 Network Sniffing
id: e2ce310a-47cd-4327-8709-1551a4c8ee63
description: 'Detection Strategy for Network Sniffing Across Platforms. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: AdminSessionDuration, CaptureCommandList.'
references:
  - https://attack.mitre.org/techniques/T1040
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_span:
    Message|contains:
      - 'monitor session'
      - 'span destination'
      - 'set port mirror'
  selection_debug_capture:
    Message|contains:
      - 'debug ip packet detail'
      - 'packet-capture'
  condition: 1 of selection_*

falsepositives:
  - Legitimate SPAN or port-mirror sessions configured by network engineers for approved traffic analysis or troubleshooting.

level: medium

Explore