T1040Credential AccessDiscovery
Network Sniffing
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit…
CVEs11
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.4
Reports1
Detections
9 Sigma rules tagged T1040Network SniffingT10409 general rules
- Cisco Sniffingmediumtest
- Harvesting Of Wifi Credentials Via Netsh.EXEmediumtest
- New Network Trace Capture Started Via Netsh.EXEmediumtest
- PktMon.EXE Executionmediumtest
- Potential Network Sniffing Activity Using Network Toolsmediumtest
- Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlockmediumtest
- Windows Pcap Driversmediumtest
- Network Sniffing - Linuxlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Network Sniffing
11 CVEs, by priority. Each link shows its badge.- CVE-2022-1040Sophos Firewall Authentication Bypass VulnerabilitySophos · FirewallKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+4 moreMITRE CTID mapping of the KEV entry · follow-on activity99.8%Top 0.04%79.9priority
- CVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityAI mapping from the description · how it is exploited98.5%Top 0.08%73.2priority
- CVE-2021-32030ASUS Routers Improper Authentication VulnerabilityASUS · RoutersKEVPublic exploitCritical · 9.8T1098Account ManipulationT1068Exploitation for Privilege Escalation+1 moreMITRE CTID mapping of the KEV entry · primary impact99.4%Top 0.06%69.8priority
- CVE-2018-18325DotNetNuke (DNN) Inadequate Encryption Strength VulnerabilityDotNetNuke (DNN) · DotNetNuke (DNN)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1040Network SniffingAI mapping from the description · primary impact74.0%Top 0.52%68.1priority
- CVE-2020-15094RCE in SymfonyMITRE CTID mapping of the CVE · how it is exploited3.0%Top 12%23.1priority
- CVE-2020-5261Missing Token Replay DetectionMITRE CTID mapping of the CVE · how it is exploited1.5%Top 26%20.6priority
- CVE-2020-15093Improper verification of signature threshold in toughMITRE CTID mapping of the CVE · primary impact1.4%Top 28%20.3priority
- CVE-2019-1715Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) SoftwareMedium · 5.3T1078Valid AccountsT1110Brute Force+2 moreMITRE CTID mapping of the CVE · primary impact1.7%Top 22%19.2priority
- CVE-2020-11035weak CSRF tokens in GLPIMITRE CTID mapping of the CVE · primary impact0.9%Top 40%17.2priority
- CVE-2020-0884A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka…Microsoft · Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)T1040Network SniffingT1528Steal Application Access TokenMITRE CTID mapping of the CVE · how it is exploited1.7%Top 23%15.4priority
- CVE-2018-14781Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replayMedtronic · MMT- 508 - MiniMed pumpMedium · 5.3T1190Exploit Public-Facing ApplicationT1040Network SniffingMITRE CTID mapping of the CVE · how it is exploited0.7%Top 46%14.4priority