aol.pm

Network Sniffing

Technique · ATTACK:enterprise:T1040

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1040",
  "title": "Network Sniffing",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1040",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3257eb21-f9a7-4430-8de1-d8b6e288f529",
  "external_id": "T1040",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:41.399Z",
  "modified": "2026-05-12T15:12:00.624Z",
  "version": "1.7",
  "aliases": [

  ],
  "tactics": [
    "credential-access",
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "AWS Traffic Mirroring",
      "url": "https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-how-it-works.html"
    },
    {
      "source_name": "capture_embedded_packet_on_software",
      "url": "https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html"
    },
    {
      "source_name": "GCP Packet Mirroring",
      "url": "https://cloud.google.com/vpc/docs/packet-mirroring"
    },
    {
      "source_name": "SpecterOps AWS Traffic Mirroring",
      "url": "https://posts.specterops.io/through-the-looking-glass-part-1-f539ae308512"
    },
    {
      "source_name": "Azure Virtual Network TAP",
      "url": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview"
    },
    {
      "source_name": "Rhino Security Labs AWS VPC Traffic Mirroring",
      "url": "https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws/"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (32)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03f1e3ee-5c1b-4897-8631-d15ed48a0730

ESET Telebots Dec 2016

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--075cdcb0-5a29-4ebb-bb0d-c2b22a5acec8

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ccddf91-2cf3-4801-a10b-ca4d253f2c8c

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f36ee85-8906-40c6-be53-87bc96499763

CISA AA20-301A Kimsuky · Netscout Stolen Pencil Dec 2018

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ff45d1d-6095-4e5a-ae11-df8c1d336b57

Mandiant UNC3886 Juniper Routers MAR 2025

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--191d6679-d6a8-42e3-b5ff-84a8d5bfb1dd

Impacket Tools

ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--306eba85-eeb9-4fcb-8b23-ce38b09bbf24

Debian nbtscan Nov 2019 · SecTools nbtscan June 2003

ATTACK:enterprise:S0443 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3318f441-6593-4a7b-bb7f-53ab15a1a672

FireEye MESSAGETAP October 2019

ATTACK:enterprise:S1206 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--335ed0b0-c96a-4868-9443-d45d05c16ba8

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d20e130-46a0-4dbe-ac36-ea620e187770

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d4e832b-28f4-4ee6-a173-dfae05df0eaf

Mandiant Fortinet Zero Day

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--706be608-c046-402e-ad71-c6042e0f88f2

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70d446a5-349f-4b70-9446-90e872adac42

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--899c49f0-4a1b-44d8-81e6-fd927a252bd6

Charles McLellan March 2016

ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9148cfab-450f-4aa7-a427-3ddf8e8d686a

Kaspersky Turla Penquin December 2014 · Leonardo Turla Penquin May 2020

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98b8b974-ac4f-4286-b657-f34f813c1d12

MSTIC FoggyWeb September 2021

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9be360bb-8ac4-4357-8795-0736b447293c

Github PowerShell Empire

ATTACK:enterprise:S0174 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c012fcf-876b-4101-aa28-6af8b00a51d2

GitHub Responder

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa03a8fe-d67f-43b8-8108-c877734044e5

Google UNC5221 Ivanti January 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa6d74b0-3db2-4679-bf1c-03d3dd7561b0

Trend Micro Banking Malware Jan 2019

ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac16a271-b0f6-4860-b790-8dbde3f68142

CCCS ArcaneDoor 2024 · Cisco ArcaneDoor 2024

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1ca60ac-cef2-467e-843c-5732d8885626

Symantec Elfin Mar 2019

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b707b5ce-7bc7-4373-bc1e-dad8cb81e74c

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S1204 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba8a5719-2e23-4bdf-9029-59a3babd66f6

Hartrell cd00r 2002

ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bca32067-c031-46fd-83dd-c1b33994d16e

Cisco ArcaneDoor 2024

ATTACK:enterprise:G0105 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2ba1f7a-1951-47df-855b-3f42a60a9901

Securelist DarkVishnya Dec 2018

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb69217e-f063-4093-bcf0-f051ecd42e25

US District Court Indictment GRU Oct 2018 · FireEye APT28 · FireEye APT28 Hospitality Aug 2017

ATTACK:enterprise:S1203 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5cd9334-11f1-42c8-b332-8a0aa884e254

Lumen J-Magic JAN 2025

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6a77085-88e6-4446-8613-2933d1f3f55e

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9fb0958-7f80-4bd5-80c2-9665124f1d0e

GitHub PoshC2

ATTACK:enterprise:S1154 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc57736f-1142-4385-82a1-8baf6b6eedc6

Lumen Versa 2024

ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcfe071b-e527-44e9-9970-9243a354f563

Kaspersky Regin

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.