PktMon.exe

File Path: C:\Windows\system32\PktMon.exe
Description: Packet Monitor

Hashes

Type	Hash
MD5	`7D0C5B06AC93C8F6078D7B1873D61E64`
SHA1	`9795F2BD164CCEF159A3E83358380172E9B5DB82`
SHA256	`A54FC1D12215A624B124AECE0C9C47491B4E3974339C5A395A4AA1C5F4FBB65B`
SHA384	`78E7FE4D2FC36AE6A15C766F3667A25E09114F6325EFAFB993D51772827CD0DAF7A0BA16245C6BEF57F157687297FF13`
SHA512	`429D9F49FA0C4242D96DDDB03FAE68350D7BFF02DD8D32D7B40741AC473F7F9CC45D7B03A6F61474DDB6BF07D388914AA91512DE87C4B2609B5283388C802E7E`
SSDEEP	`1536:3BPUgMpBfGzVRwaiYvcDn1W/jQO/415Kt7mjExeFZzuDpTSUn2qfOz:eRE3T9cD1W/jQOm5Kt7m18DI+3fU`

Runtime Data

Usage (stdout):

pktmon { filter | comp | reset | start | stop } [OPTIONS | help]
    Monitor internal packet propagation and packet drop reports.

Commands
    filter     Manage packet filters.
    comp       Manage registered components.

    reset      Reset counters to zero.
    start      Start packet monitoring.
    stop       Stop monitoring.

help
    Show help text for a command.

Usage (stderr):

Unknown command '--help'. See pktmon  help.

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\PktMon.exe

Signature

Status: Signature verified.
Serial: 330000026551AE1BBD005CBFBD000000000265
Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: PktMon.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.17763.1 (WinBuild.160101.0800)
Product Version: 10.0.17763.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of PktMon.exe being misused. While PktMon.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	win_pcap_drivers.yml	`- 'pktmon'`	DRL 1.0
LOLBAS	Pktmon.yml	`Name: Pktmon.exe`
LOLBAS	Pktmon.yml	`- Command: pktmon.exe start --etw`
LOLBAS	Pktmon.yml	`Description: Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop`
LOLBAS	Pktmon.yml	`- Command: pktmon.exe filter add -p 445`
LOLBAS	Pktmon.yml	`- Path: c:\windows\system32\pktmon.exe`
LOLBAS	Pktmon.yml	`- Path: c:\windows\syswow64\pktmon.exe`

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

pktmon

Applies to: Windows Server 2022, Windows Server 2019, Windows 10, Azure Stack HCI, Azure Stack Hub, Azure

Packet Monitor (Pktmon) is an in-box, cross-component network diagnostics tool for Windows. It can be used for advanced packet capture and event collection, drop detection, filtering, and counting. Pktmon is especially helpful in virtualization scenarios such as container networking and SDN, because it provides visibility within the networking stack.

Syntax

pktmon { filter | list | start | stop | status | unload | counters | reset | etl2txt | etl2pcap | hex2pkt | help } [options]

Commands

Command	Description
pktmon filter	Manage packet filters.
pktmon list	List packet processing components.
pktmon start	Start packet capture and event collection.
pktmon stop	Stop data collection.
pktmon status	Query current status.
pktmon unload	Unload PktMon driver.
pktmon counters	Display current packet counters.
pktmon reset	Reset packet counters to zero.
pktmon etl2txt	Convert log file to text format.
pktmon etl2pcap	Convert log file to pcapng format.
pktmon hex2pkt	Decode packet in hexadecimal format.
pktmon help	Show help text for specific command.