🌐🛜👃

Adversaries may passively 👃 network traffic to capture information about an environment, including authentication material passed over the network. 🌐🛜👃 refers to using the network interface on a system to 👀 or capture information sent over a wired or wireless connection. An 😈 may place a 🛜 interface into promiscuous mode to passively access data in transit 🌈 the 🛜, or use span ports to capture a larger amount of data.

Data captured via this technique may include user credentials, especially those sent over an insecure, 🔓 protocol. Techniques for name service resolution ☠, such as LLMNR/NBT-NS Poisoning and SMB Relay, can also be used to capture 🪪 to websites, proxies, and internal systems by redirecting 🚦 to an adversary.

🌐 🛜👃 may reveal configuration details, such as 🏃services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Defense Evasion activities. Adversaries may likely also utilize 🌐🛜👃 during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment.

In ☁️ -based environments, adversaries may still be able to use traffic 🪞 services to 👃 network traffic from virtual machines. For example, AWS 🚦 Mirroring, GCP Packet 🪞, and Azure vTap allow users to define specified instances to collect traffic from and specified 🎯 🎯 to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of 🔑 🔒 and 🔑 🔓 traffic. The 😈 can then use exfiltration techniques such as Transfer Data to ☁️ Account in order to access the sniffed traffic.

On network devices, adversaries may perform 🌐 🛜 captures using Network Device CLI 🗣️ such as monitor capture.