LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Pktmon.exe

View source

Capture Network Packets on the windows 10 with October 2018 Update or later.

Reconnaissance
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Reconnaissance2

EXAMPLE 01T1040

Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop

COMMAND
pktmon.exe start --etw
USE CASE
use this a built in network sniffer on windows 10 to capture senstive traffic
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10 1809 and later, Windows 11
EXAMPLE 02T1040

Select Desired ports for packet capture

COMMAND
pktmon.exe filter add -p 445
USE CASE
Look for interesting traffic such as telent or FTP
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10 1809 and later, Windows 11
02 / ON DISK

Known paths

c:\windows\system32\pktmon.exe
c:\windows\syswow64\pktmon.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    .etl files found on system

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Derek Johnson