Windows

Pktmon.exePktmon.exe

Platform
Windows
Abuse functions
2
Mapped techniques
1

Description

Pktmon.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Reconnaissance. Mapped ATT&CK techniques (per LOLBAS / GTFOBins → MITRE crosswalk): T1083. Defenders should monitor execution of Pktmon.exe under non-administrative or sudo contexts and alert when its arguments match the abuse-function signatures.

Abuse functions· 2

ReconnaissanceT1040

use this a built in network sniffer on windows 10 to capture senstive traffic

ReconnaissanceT1040

Look for interesting traffic such as telent or FTP

MITRE ATT&CK techniques· 1

T1040

Uses1

TypeTargetConfidenceTier
TechniqueNetwork Sniffingt1040100%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

LOLbin
Pnputil.exe
LOLbin
ProtocolHandler.exe
LOLbin
Tttracer.exe
LOLbin
Powerpnt.exe
LOLbin
Nmcap.exe
LOLbin
Pcwrun.exe
Sourced from LOLBAS Project. Curated by Adam Lundqvist, SQUR.