| splunk |
Windows Network Sniffing Tool Executed |
production |
2026-10-02 |
| elastic |
Azure VNet Full Network Packet Capture Enabled |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launched Inside A Container |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launch Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
AWS EC2 Full Network Packet Capture Detected |
production |
2026-09-18 |
| splunk |
Cisco SNMP Community String Configuration Changes |
production |
2026-05-13 |
| splunk |
Cisco ASA - Packet Capture Activity |
production |
2026-05-13 |
| sigma |
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock |
test |
2024-05-12 |
| sigma |
PktMon.EXE Execution |
test |
2023-06-23 |
| sigma |
Windows Pcap Drivers |
test |
2023-04-14 |
| sigma |
Potential Network Sniffing Activity Using Network Tools |
test |
2023-02-20 |
| sigma |
Harvesting Of Wifi Credentials Via Netsh.EXE |
test |
2023-02-13 |
| sigma |
New Network Trace Capture Started Via Netsh.EXE |
test |
2023-02-13 |
| sigma |
Cisco Sniffing |
test |
2023-01-04 |
| sigma |
Network Sniffing - Linux |
test |
2022-12-18 |
| sigma |
Network Sniffing - MacOs |
test |
2022-11-26 |
| elastic |
Network Sniffing via Tcpdump |
deprecated |
2021-04-15 |
| sentinel |
Zoom E2E Encryption Disabled |
Scheduled |
— |