title: Use of PktMon.exe
id: f956c7c1-0f60-4bc5-b7d7-b39ab3c08908
status: experimental
description: Tools to Capture Network Packets on the windows 10 with October 2018 Update or later.
author: frack113
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
date: 2022/03/17
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: PktMon.exe
    - OriginalFileName: PktMon.exe
  condition: selection
falsepositives:
  - Legitimate use
level: medium
tags:
  - attack.credential_access
  - attack.t1040
