PktMon.EXE Execution

Title: PktMon.EXE Execution
Status: test
Description:Detects execution of PktMon, a tool that captures network packets.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
Author: frack113
Date: 2022-03-17
modified:2023-06-23
Tags:

• -'attack.discovery'
• -'attack.credential-access'
• -'attack.t1040'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\pktmon.exe' OriginalFileName:'PktMon.exe'   condition:selection
Falsepositives:
  -Legitimate use
Level: medium