Pktmon.exe

Capture Network Packets on the windows 10 with October 2018 Update or later.

Reconnaissance

use this a built in network sniffer on windows 10 to capture senstive traffic

pktmon.exe start --etw

Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop — MITRE: T1040 — Privileges: Administrator

Look for interesting traffic such as telent or FTP

pktmon.exe filter add -p 445

Select Desired ports for packet capture — MITRE: T1040 — Privileges: Administrator