Potential Packet Capture Activity Via Start-NetEventSession in PowerShell ScriptBlock

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•25

Detects the execution of PowerShell scripts that use the 'Start-NetEventSession' cmdlet to initiate network event and packet capture. This activity can be leveraged by adversaries to sniff network traffic, potentially capturing sensitive information like user credentials, especially when transmitted over unencrypted protocols. This technique is often used for information gathering during an operation.