Procedure examples

cd00r can use the libpcap library to monitor captured packets for specifc sequences.

JumbledPath has the ability to perform packet capture on remote devices via actor-defined jump-hosts.

VersaMem hooked the Catalina application filter chain `doFilter` on compromised systems to monitor all inbound requests to the local Tomcat web server, inspecting them for parameters like passwords and follow-on Java modules.

CASTLETAP has the ability to create a raw promiscuous socket to sniff network traffic.

J-magic has a pcap listener function that can create an Extended Berkley Packet Filter (eBPF) on designated interfaces and ports.

Emotet has been observed to hook network APIs to monitor network traffic.

Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.

Line Dancer can create and exfiltrate packet captures from compromised environments.

FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.

MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.

Penquin can sniff network traffic to look for packets matching specific conditions.

SPAWNCHIMERA has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control.

Impacket can be used to sniff network traffic via an interface or raw socket.

Empire can be used to conduct packet captures on target hosts.

PoshC2 contains a module for taking packet captures on compromised hosts.

Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.

NBTscan can dump and print whole packet content.