.. / Add-NetEventPacketCaptureProvider

Adds a Remote Packet Capture provider


Functions:
Type:
Toolsets:

Network

Add packet capture provider to eventsession

Add-NetEventPacketCaptureProvider -SessionName sess -CimSession $s -Level 4 -CaptureType Physical -TruncationLength ([UInt16]::MaxValue)
Usecase
Sniff authentication traffic on a domain controller and locally crack the hashes

Comments
Mitre Att&ck
T1047




Updated: 2023-11-04
Contributor: Arris Huijgen (bitsadmin)