Techniques › T1205.002 › AN0462
AN0462 Analytic 0462
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary installs/uses packet-capture or raw-socket capability (WinPcap/Npcap, wpcap/packet DLLs or raw socket attach) and sets a filter. A crafted inbound packet is observed; within a short window the host process that loaded capture libraries initiates an outbound connection (e.g., reverse shell) to the packet origin.</p>
- Detects
- T1205.002 Socket Filters
- Part of
- DET0162 Socket-filter trigger → on-host raw-socket activity → reverse connection (T1205.002)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:System | EventCode=7045 | DC0060 Service Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=6 | DC0079 Driver Load |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| NSM:Flow | Single, low-volume inbound packet (REJ/S0/OTH or uncommon dport/protocol) from src_ip followed by outbound SF connection to src_ip. | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Seconds to correlate inbound trigger → process library load/driver start → outbound connect (default 120s). |
CaptureLibIndicators | DLL/driver names to match (wpcap.dll, packet.dll, npcap.sys, npf.sys) – extend for EDR drivers in your fleet. |
AllowedInstallers | Signed/expected processes allowed to install/start Npcap (software distribution tools). |
ReversePorts | Likely egress ports to watch after trigger (4444, 53, 80/443, 8080, high ephemeral). |