Sigma rule: Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock

Rule

Title

Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock

Status

test

Level

medium

Author

frack113

Date

2024-05-12

File

rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session.
Adversaries may attempt to capture network to gather information over the course of an operation.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection:
    ScriptBlockText|contains: 'Start-NetEventSession'
condition: selection

False positives (as the rule lists them)

• Legitimate network diagnostic scripts.

Tags

• attack.credential-access
• attack.discovery
• attack.t1040

MITRE ATT&CK ids this rule names

• T1040

References

• https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
• https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md
• https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_packet_capture.yml