---
title: Network Sniffing via Tcpdump
description: The Tcpdump program ran on a Linux host. Tcpdump is a network monitoring or packet sniffing tool that can be used to capture insecure credentials or data...
url: https://www.elastic.co/elastic/docs-builder/docs/3167/reference/security/prebuilt-rules/rules/_deprecated/credential_access_tcpdump_activity
products:
  - Elastic Security
---

# Network Sniffing via Tcpdump
<warning>
  This rule has been deprecated as of 2021/04/15.
</warning>

The Tcpdump program ran on a Linux host. Tcpdump is a network monitoring or packet sniffing tool that can be used to
capture insecure credentials or data in motion. Sniffing can also be used to discover details of network services as a
prelude to lateral movement or defense evasion.
**Rule type**: query
**Rule indices**:
- auditbeat-*
- logs-endpoint.events.*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
**Tags**:
- Elastic
- Host
- Linux
- Threat Detection
- Credential Access

**Version**: 100
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Rule Query

```kuery
event.category:process and event.type:(start or process_started) and process.name:tcpdump
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Credential Access
- Id: TA0006
- Reference URL: [[https://attack.mitre.org/tactics/TA0006/](https://attack.mitre.org/tactics/TA0006/)](https://attack.mitre.org/tactics/TA0006/)
- Technique:
  - Name: Network Sniffing
- Id: T1040
- Reference URL: [[https://attack.mitre.org/techniques/T1040/](https://attack.mitre.org/techniques/T1040/)](https://attack.mitre.org/techniques/T1040/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
- Id: TA0007
- Reference URL: [[https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Network Sniffing
- Id: T1040
- Reference URL: [[https://attack.mitre.org/techniques/T1040/](https://attack.mitre.org/techniques/T1040/)](https://attack.mitre.org/techniques/T1040/)