PktMon.exe

  • File Path: C:\Windows\system32\PktMon.exe
  • Description: Packet Monitor

Hashes

Type Hash
MD5 7D0C5B06AC93C8F6078D7B1873D61E64
SHA1 9795F2BD164CCEF159A3E83358380172E9B5DB82
SHA256 A54FC1D12215A624B124AECE0C9C47491B4E3974339C5A395A4AA1C5F4FBB65B
SHA384 78E7FE4D2FC36AE6A15C766F3667A25E09114F6325EFAFB993D51772827CD0DAF7A0BA16245C6BEF57F157687297FF13
SHA512 429D9F49FA0C4242D96DDDB03FAE68350D7BFF02DD8D32D7B40741AC473F7F9CC45D7B03A6F61474DDB6BF07D388914AA91512DE87C4B2609B5283388C802E7E
SSDEEP 1536:3BPUgMpBfGzVRwaiYvcDn1W/jQO/415Kt7mjExeFZzuDpTSUn2qfOz:eRE3T9cD1W/jQOm5Kt7m18DI+3fU

Runtime Data

Usage (stdout):

pktmon { filter | comp | reset | start | stop } [OPTIONS | help]
    Monitor internal packet propagation and packet drop reports.

Commands
    filter     Manage packet filters.
    comp       Manage registered components.

    reset      Reset counters to zero.
    start      Start packet monitoring.
    stop       Stop monitoring.

help
    Show help text for a command.


Usage (stderr):

Unknown command '--help'. See pktmon  help.

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\PktMon.exe

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: PktMon.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of PktMon.exe being misused. While PktMon.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_pcap_drivers.yml - 'pktmon' DRL 1.0
LOLBAS Pktmon.yml Name: Pktmon.exe  
LOLBAS Pktmon.yml - Command: pktmon.exe start --etw  
LOLBAS Pktmon.yml Description: Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop  
LOLBAS Pktmon.yml - Command: pktmon.exe filter add -p 445  
LOLBAS Pktmon.yml - Path: c:\windows\system32\pktmon.exe  
LOLBAS Pktmon.yml - Path: c:\windows\syswow64\pktmon.exe  

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


pktmon

Applies to: Windows Server 2022, Windows Server 2019, Windows 10, Azure Stack HCI, Azure Stack Hub, Azure

Packet Monitor (Pktmon) is an in-box, cross-component network diagnostics tool for Windows. It can be used for advanced packet capture and event collection, drop detection, filtering, and counting. Pktmon is especially helpful in virtualization scenarios such as container networking and SDN, because it provides visibility within the networking stack.

Syntax

pktmon { filter | list | start | stop | status | unload | counters | reset | etl2txt | etl2pcap | hex2pkt | help } [options]

Commands

Command Description
pktmon filter Manage packet filters.
pktmon list List packet processing components.
pktmon start Start packet capture and event collection.
pktmon stop Stop data collection.
pktmon status Query current status.
pktmon unload Unload PktMon driver.
pktmon counters Display current packet counters.
pktmon reset Reset packet counters to zero.
pktmon etl2txt Convert log file to text format.
pktmon etl2pcap Convert log file to pcapng format.
pktmon hex2pkt Decode packet in hexadecimal format.
pktmon help Show help text for specific command.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.