SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Network and infrastructure attacks

Packet sniffing

Passive capture of traffic to harvest credentials and tokens

categoryNetwork and infrastructure attacksseverityVery Highdetectability (measured in our lab)Mediumlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1040 · PowerShell Network Sniffing · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1040 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1040 -TestGuids 9c15a7de-de14-46c3-bc2a-6d94130986ae -TimeoutSeconds 120'
ATT&CK T1040 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1040 -Tool atomic -RunId run-2026-10-14-014 -Command 'Invoke-AtomicTest T1040 -TestGuids 9c15a7de-de14-46c3-bc2a-6d94130986ae -TimeoutSeconds 120'
ATT&CK T1040 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1040 -Tool atomic -RunId run-2026-10-18-008 -Command 'Invoke-AtomicTest T1040 -TestGuids 9c15a7de-de14-46c3-bc2a-6d94130986ae -TimeoutSeconds 120'

+ 4 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-28 · detected in 25s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1Packet capture session started via PowerShell NetEventPacketCapture cmdlets (network sniffing) -- T1040
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104Powershell script searching filesystem
PowerShell · EID 4104Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624Non network or service local logon.
… and 6 more event type(s)

Detection that fired

  • ✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent
  • ✓ Wazuh 100424 (level 6) lab rule — Packet capture session started via PowerShell NetEventPacketCapture cmdlets (network sniffing) -- T1040
  • ✓ Wazuh 100425 (level 6) lab rule — Packet capture session started via PowerShell NetEventPacketCapture cmdlets (network sniffing) (Security 4688 arm) -- T1040

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100422, 100423 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~65179 incidental alerts/hour — tune against this.

detected windows · 2026-10-28 · detected in 70s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Packet capture session started via PowerShell NetEventPacketCapture cmdlets (network sniffing) -- T1040
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104Powershell script searching filesystem
PowerShell · EID 4104Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624Non network or service local logon.
Security · EID 4634Non service account logged off.
… and 4 more event type(s)

Detection that fired

  • ✓ Wazuh 100424 (level 6) lab rule — Packet capture session started via PowerShell NetEventPacketCapture cmdlets (network sniffing) -- T1040
  • ✓ Wazuh 100425 (level 6) lab rule — Packet capture session started via PowerShell NetEventPacketCapture cmdlets (network sniffing) (Security 4688 arm) -- T1040

Plus 10 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~67680 incidental alerts/hour — tune against this.

Classification

30 values: 9 reviewed, 3 lab-measured, 13 imported, 5 derived. What do these mean?

Exploitability

Attack vectorNetwork attacks
Reach (CVSS)Adjacent
Attack complexityLow
Privileges requiredNone
User interactionNone
Attacker skill requiredLow
Resources requiredLow
Likelihood / prevalenceMedium
MaturityCommoditized

Impact & scope

SeverityVery High
ImpactConfidentiality
PlatformIaaSLinuxmacOSNetwork DevicesWindows
EnvironmentOn-premises
Target asset classIdentityNetwork device
Kill-chain phase (tactic)Credential AccessDiscovery

Detection & telemetry

Detectability (measured in our lab)Medium
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team test
Data sources (ATT&CK data components)Cloud Service ModificationCommand ExecutionNetwork Traffic ContentProcess CreationService Creation

Detection & response

Mitigated by 5

  • M1018 attack-mitigation
  • M1030 attack-mitigation
  • M1032 attack-mitigation
  • M1041 attack-mitigation
  • D3-DNSTA d3fend

Detected by 12

  • DET0314 attack-detection-strategy
  • 42b1a5b8-353f-4f10-b256-39de4467faff sigma
  • 7b687634-ab20-11ea-bb37-0242ac130002 sigma
  • adc9bcc4-c39c-4f6b-a711-1884017bf043 sigma
  • b9e1f193-d236-4451-aaae-2f3d2102120d sigma
  • ba1f7802-adc7-48b4-9ecb-81e227fddfd5 sigma
  • d3c3861d-c504-4c77-ba55-224ba82d0118 sigma
  • da34e323-1e65-42db-83be-a6725ac2caa3 sigma
  • f4d3748a-65d1-4806-bd23-e25728081d01 sigma
  • f956c7c1-0f60-4bc5-b7d7-b39ab3c08908 sigma
  • 100424 wazuh
  • 100425 wazuh

Tested by 16

  • 10c710c9-9104-4d5f-8829-5b65391e2a29 atomic
  • 515575ab-d213-42b1-aa64-ef6a2dd4641b atomic
  • 7a0895f0-84c1-4adf-8491-a21510b1d4c1 atomic
  • 7fe741f7-b265-4951-a7c7-320889083b3e atomic
  • 855fb8b4-b8ab-4785-ae77-09f5df7bff55 atomic
  • 9c15a7de-de14-46c3-bc2a-6d94130986ae atomic
  • 9d04efee-eff5-4240-b8d2-07792b873608 atomic
  • a3a0d4c9-c068-4563-a08d-583bd05b884c atomic
  • a5b2f6a0-24b4-493e-9590-c699f75723ca atomic
  • b1cbdf8b-6078-48f5-a890-11ea19d7f8e9 atomic
  • b5656f67-d67f-4de8-8e62-b5581630f528 atomic
  • c67ba807-f48b-446e-b955-e4928cd1bf91 atomic
  • c93f2492-9ebe-44b5-8b45-36574cccfe67 atomic
  • e2028771-1bfb-48f5-b5e6-e50ee0942a14 atomic
  • e2480aee-23f3-4f34-80ce-de221e27cd19 atomic
  • e6fe5095-545d-4c8b-a0ae-e863914be3aa atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-14-014partially-detectedatomicwindows2026-10-14
run-2026-10-18-008partially-detectedatomicwindows2026-10-18
run-2026-10-27-009partially-detectedatomicwindows2026-10-27
run-2026-10-28-008partially-detectedatomicwindows2026-10-28
run-2026-10-28-010detectedatomicwindows2026-10-28
run-2026-10-28-014detectedatomicwindows2026-10-28
  • run-2026-10-14-014 — Backlog detectability-baseline probe (priority 5, 3 corpus attack(s); atomic_tests=16). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1040 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90
  • run-2026-10-18-008 — Backlog detectability-baseline probe (priority 5, 3 corpus attack(s); atomic_tests=16). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1040 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1528 max_level=15 dwell_s=90
  • run-2026-10-27-009 — Backlog detectability-baseline probe (priority 5, 3 corpus attack(s); atomic_tests=16). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1040 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1843 max_level=15 dwell_s=90
  • run-2026-10-28-008 — Backlog detectability-baseline probe (priority 5, 3 corpus attack(s); atomic_tests=16). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1040 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1780 max_level=15 dwell_s=90
  • run-2026-10-28-010 — Backlog detectability-baseline probe (priority 5, 3 corpus attack(s); atomic_tests=16). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1040 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=1786 max_level=15 dwell_s=90
  • run-2026-10-28-014 — Backlog detectability-baseline probe (priority 5, 3 corpus attack(s); atomic_tests=16). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1040 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=1720 max_level=15 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 182 of Cyber-Attack-Taxonomy.md
  • ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 28 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0003 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-014 (partially-detected) for T1040: no alert matched the expected technique
  • ev-0004 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-008 (partially-detected) for T1040: no alert matched the expected technique
  • ev-0005 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-009 (partially-detected) for T1040: no alert matched the expected technique
  • ev-0006 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-008 (partially-detected) for T1040: no alert matched the expected technique
  • ev-0007 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-010 (detected): Wazuh rule(s) 100424, 100425 fired on T1040 within the detonation window
    Packet capture session started via PowerShell NetEventPacketCapture cmdlets (network sniffing) (Security 4688 arm) -- T1040
  • ev-0008 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-014 (detected): Wazuh rule(s) 100424, 100425 fired on T1040 within the detonation window
    Packet capture session started via PowerShell NetEventPacketCapture cmdlets (network sniffing) -- T1040