LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Nmcap.exe

View source

Command-line packet capture utility from Microsoft Network Monitor 3.x.

Reconnaissance
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Reconnaissance1

EXAMPLE 01T1040

Start capture on all network adapters and save to specified .cap (circular) file. Optionally, one can add: - `/TerminateWhen /TimeAfter 30 seconds` to auto-terminate after a relative times (e.g. 30 seconds); - `/TerminateWhen /Time 04:52:00 AM 9/17/2025` to auto-terminate after a specific date/time; - `/TerminateWhen /KeyPress x` to terminate when a specific key is pressed.

COMMAND
nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}
USE CASE
Capture network traffic on windows to collect sensitive data.
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows
02 / ON DISK

Known paths

C:\Program Files\Microsoft Network Monitor 3\nmcap.exe
C:\Program Files (x86)\Microsoft Network Monitor 3\nmcap.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

No detection resources documented yet.

Contribute detection coverage
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Avihay Eldad@AvihayEldad