Identifier / Programs / Windows

pktmon.exe

Packet Monitor (Pktmon) is an in-box, cross-component network diagnostics tool for Windows. Windows commands reference

LOLBAS Reconnaissance 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 7 known copies with hashes

How pktmon.exe is abused

documented by LOLBAS

Reconnaissance T1040 Network Sniffing

--etw

Reconnaissance T1040 Network Sniffing

filter add

-pMatch source or destination port number. Windows commands reference

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for pktmon.exe.

2 documented commands

from LOLBAS, each read by the identifier

Reconnaissance T1040 Network Sniffing Administrator privileges

Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop

pktmon.exe start --etw

Identify

Trips 1 Sigma rule: mediumPktMon.EXE Execution by frack113

Reconnaissance T1040 Network Sniffing Administrator privileges

Select Desired ports for packet capture

pktmon.exe filter add -p 445

Identify

Trips 1 Sigma rule: mediumPktMon.EXE Execution by frack113

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for pktmon.exe, by Derek Johnson, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for pktmon.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumPktMon.EXE Executionfrack113

T1040Network Sniffing

Is it the real pktmon.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionPacket Monitor

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PktMon.exe · signed by Microsoft Windows

4874d302422ad10827b3d58ce68daaab7e3b99d9cdb0850801f9a00105a4df56

10.0.19041.906 (WinBuild.160101.0800) · C:\Windows\system32\PktMon.exe · signed by Microsoft Windows

d7a5e957eff4dce4712c0d9e9d465d803ebf47401dd1ab3bb5ddcdbd15d02c90

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\PktMon.exe · signed by Microsoft Windows

4714b03ffa5c666572a4ab6b04310a6ca654c3c1c68edd3696088c238628bbb6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PktMon.exe · signed by Microsoft Windows

927b2e0b365d53668a31be9b20ad284239faf3eda57a991ca479bb1b14af9941

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PktMon.exe · signed by Microsoft Windows

395364bae8eb95fe58397f4b408a1d8bc3205529a375b979409dd9fd0e26a00c

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\system32\PktMon.exe · signed by Microsoft Windows

5a5e71245f9fc0d109452fe867192ceae3cfe7803950eab2f4e0a7bda8677dd4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\PktMon.exe · signed by Microsoft Windows

a54fc1d12215a624b124aece0c9c47491b4e3974339c5a395a4aa1c5f4fbb65b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.