Pktmon.exe

Capture Network Packets on the windows 10 with October 2018 Update or later.

Paths

• c:\windows\system32\pktmon.exe
• c:\windows\syswow64\pktmon.exe

Commands

Reconnaissance

Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop

Use case: use this a built in network sniffer on windows 10 to capture senstive traffic

Privileges: Administrator

pktmon.exe start --etw

Reconnaissance

Select Desired ports for packet capture

Use case: Look for interesting traffic such as telent or FTP

Privileges: Administrator

pktmon.exe filter add -p 445

Detection

• Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_pktmon.yml
• IOC: .etl files found on system

Resources

• https://binar-x79.com/windows-10-secret-sniffer/