attack_technique: T1040
display_name: Network Sniffing
atomic_tests:
- name: Packet Capture Linux
  auto_generated_guid: 7fe741f7-b265-4951-a7c7-320889083b3e
  description: |
    Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.

    Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface ens33.
  supported_platforms:
  - linux
  input_arguments:
    interface:
      description: Specify interface to perform PCAP on.
      type: String
      default: ens33
  dependency_executor_name: bash
  dependencies:
    - description: |
        Check if at least one of tcpdump or tshark is installed.
      prereq_command: |
        if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi;
      get_prereq_command: |
        (which yum && yum -y epel-release tcpdump tshark)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)
  executor:
    command: |
      tcpdump -c 5 -nnni #{interface}
      tshark -c 5 -i #{interface}
    name: bash
    elevation_required: true
- name: Packet Capture macOS
  auto_generated_guid: 9d04efee-eff5-4240-b8d2-07792b873608
  description: |
    Perform a PCAP on macOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed.

    Upon successful execution, tshark or tcpdump will execute and capture 5 packets on interface en0A.
  supported_platforms:
  - macos
  input_arguments:
    interface:
      description: Specify interface to perform PCAP on.
      type: String
      default: en0A
  dependency_executor_name: bash
  dependencies:
    - description: |
        Check if at least one of tcpdump or tshark is installed.
      prereq_command: |
        if [ ! -x "$(command -v tcpdump)" ] && [ ! -x "$(command -v tshark)" ]; then exit 1; else exit 0; fi;
      get_prereq_command: |
        (which yum && yum -y epel-release tcpdump tshark)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y tcpdump tshark)
  executor:
    command: |
      sudo tcpdump -c 5 -nnni #{interface}    
      if [ -x "$(command -v tshark)" ]; then sudo tshark -c 5 -i #{interface}; fi;
    name: bash
    elevation_required: true
- name: Packet Capture Windows Command Prompt
  auto_generated_guid: a5b2f6a0-24b4-493e-9590-c699f75723ca
  description: |
    Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
    installed.

    Upon successful execution, tshark will execute and capture 5 packets on interface "Ethernet".
  supported_platforms:
  - windows
  input_arguments:
    interface:
      description: Specify interface to perform PCAP on.
      type: String
      default: Ethernet
    wireshark_url:
      description: wireshark installer download URL
      type: Url
      default: https://1.eu.dl.wireshark.org/win64/Wireshark-win64-latest.exe
    tshark_path:
      description: path to tshark.exe 
      type: Path
      default: c:\program files\wireshark\tshark.exe
    npcap_url:
      description: npcap installed download URL
      type: Url
      default: https://nmap.org/npcap/dist/npcap-1.31.exe
    npcap_path:
      description: path to npcap.sys
      type: Path
      default: C:\Program Files\Npcap\npcap.sys
  dependency_executor_name: powershell
  dependencies:
    - description: |
       tshark must be installed and in the default path of "c:\Program Files\Wireshark\Tshark.exe".
      prereq_command:
        if (test-path "#{tshark_path}") {exit 0} else {exit 1}
      get_prereq_command: |
        Invoke-WebRequest -OutFile $env:temp\wireshark_installer.exe #{wireshark_url}
        Start-Process $env:temp\wireshark_installer.exe /S
    - description: |
       npcap must be installed.
      prereq_command:
        if (test-path "#{npcap_path}") {exit 0} else {exit 1}
      get_prereq_command: |
        Invoke-WebRequest -OutFile $env:temp\npcap_installer.exe #{npcap_url}
        Start-Process $env:temp\npcap_installer.exe
  executor:
    command: |
      "c:\Program Files\Wireshark\tshark.exe" -i #{interface} -c 5
    name: command_prompt
    elevation_required: true
- name: Windows Internal Packet Capture
  auto_generated_guid: b5656f67-d67f-4de8-8e62-b5581630f528
  description: |-
    Uses the built-in Windows packet capture
    After execution you should find a file named trace.etl and trace.cab in the temp directory
  supported_platforms:
  - windows
  executor:
    command: netsh trace start capture=yes tracefile=%temp%\trace.etl maxsize=10
    cleanup_command: |-
      netsh trace stop >nul 2>&1
      TIMEOUT /T 5 >nul 2>&1
      del %temp%\trace.etl >nul 2>&1
      del %temp%\trace.cab >nul 2>&1
    name: command_prompt
    elevation_required: true
  
