AN0875
Analytic 0875
Windows
Detects suspicious execution of network monitoring tools (e.g., Wireshark, tshark, Microsoft Message Analyzer), driver loading indicative of promiscuous mode, or non-admin user privilege escalation to access NICs for capture.
WinEventLog:Security
EventCode=4688
WinEventLog:System
EventCode=7045
[ToolNames]
Adjust list of known sniffing tools based on environment and known administrator usage.
[TimeWindow]
Tune time of day or frequency of capture sessions to reduce false positives from authorized use.
AN0876
Analytic 0876
Linux
Correlates interface mode changes to promiscuous with execution of sniffing tools like tcpdump, tshark, or custom pcap libraries. Detects abnormal NIC configurations and unauthorized sniffing from non-root sessions.
auditd:SYSCALL
execve, setifflags
auditd:SYSCALL
promiscuous mode transitions (ioctl or ifconfig)
networkconfig
interface flag PROMISC, netstat | ip link | ethtool
[InterfaceList]
Limit analysis to external interfaces (e.g., eth0, wlan0) and exclude virtual adapters.
[PromiscuousSessionThreshold]
Raise alerts if interface remains in PROMISC longer than threshold duration.
AN0877
Analytic 0877
macOS
Detects enabling of interface sniffing via packet capture tools or AppleScript triggering `tcpdump`. Leverages Unified Logs and process lineage to identify suspicious use of `pfctl`, `tcpdump`, or `libpcap` libraries.
macos:unifiedlog
eventMessage = 'promiscuous'
macos:osquery
process_events where path like '%tcpdump%'
fs:fsusage
access to BPF devices or interface IOCTLs
[AllowedTools]
Whitelist Apple-native tools used by IT admins and mobile device management (MDM).
[UserContext]
Prioritize detections from non-admin or low-privilege users performing packet captures.
AN0878
Analytic 0878
IaaS
Detects creation of traffic mirroring sessions (e.g., AWS VPC Traffic Mirroring, Azure vTAP) that redirect traffic from critical assets to other virtual instances, often followed by file creation or session establishment.
AWS:CloudTrail
CreateTrafficMirrorSession / ModifyTrafficMirrorTarget
[MirrorSourceList]
Identify VMs or containers where mirror sessions are abnormal or unexpected.
[TargetIAMRole]
Monitor whether mirror target roles match administrative expectations.
AN0879
Analytic 0879
Network Devices
Detects execution of capture commands via CLI (`monitor capture`, `debug packet`, etc.) or unauthorized CLI access followed by logging configuration changes on Cisco/Juniper/Arista gear.
networkdevice:syslog
admin login events
networkdevice:syslog
exec command='monitor capture'
networkdevice:syslog
config change (e.g., logging buffered, pcap buffers)
[AdminSessionDuration]
Tunable alerting threshold for interactive CLI sessions.
[CaptureCommandList]
Define set of known capture/debug commands per vendor to flag unexpected usage.