Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock

frack113

Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

2024-05-12 00:00:00

None

da34e323-1e65-42db-83be-a6725ac2caa3

attack.credential_access attack.discovery attack.t1040 DEMO

Community Rule

frack113

Merge PR #4852 from @frack113 - Add `Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock`

2024-05-13