Nasreddine Bencherchali
598d29f811
chore: change tags, date, modified fields to comply with v2 of the Sigma spec. chore: update the related type from `obsoletes` to `obsolete`. chore: update local json schema to the latest version.
42 lines
1.0 KiB
YAML
42 lines
1.0 KiB
YAML
title: Windows Pcap Drivers
|
|
id: 7b687634-ab20-11ea-bb37-0242ac130002
|
|
status: test
|
|
description: Detects Windows Pcap driver installation based on a list of associated .sys files.
|
|
references:
|
|
- https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more
|
|
author: Cian Heasley
|
|
date: 2020-06-10
|
|
modified: 2023-04-14
|
|
tags:
|
|
- attack.discovery
|
|
- attack.credential-access
|
|
- attack.t1040
|
|
logsource:
|
|
product: windows
|
|
service: security
|
|
definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
|
|
detection:
|
|
selection:
|
|
EventID: 4697
|
|
ServiceFileName|contains:
|
|
- 'pcap'
|
|
- 'npcap'
|
|
- 'npf'
|
|
- 'nm3'
|
|
- 'ndiscap'
|
|
- 'nmnt'
|
|
- 'windivert'
|
|
- 'USBPcap'
|
|
- 'pktmon'
|
|
condition: selection
|
|
fields:
|
|
- EventID
|
|
- ServiceFileName
|
|
- Account_Name
|
|
- Computer_Name
|
|
- Originating_Computer
|
|
- ServiceName
|
|
falsepositives:
|
|
- Unknown
|
|
level: medium
|