PktMon.exe Execution for Network Sniffing

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects the execution of PktMon.exe, a legitimate Windows utility that can be used to capture network packets. Adversaries may abuse this tool for network sniffing to gather information about the environment, including potential credentials or network configurations.