Investigation: Network Monitor nmcap Traffic Capture

1. Confirm the alert

   Detects Microsoft Network Monitor's nmcap.exe launched to capture network traffic. A rare binary on endpoints; attackers use it for on-host packet capture / credential sniffing. Authored from public Microsoft documentation. The rule matched on logsource `process_creation`. Verify the event genuinely matches the described behavior, and not a known legitimate case. The rule matches on these fields — examine the exact value in the event:

   • **CommandLine** contains: `/capture`
   • **Image** contains: `\nmcap.exe`

2. Pivot: find the origin and context

   Investigation queries (read-only):

   • Parent of the triggering process (full execution chain)
   • Other processes spawned by the same parent within 10 minutes
   • Is the binary signed? unusual path (%TEMP%, %APPDATA%, user directory)?

3. Rule out false positives

   Known benign causes for this rule:

   • Legitimate network troubleshooting by IT staff; rare enough to review.

4. Context (threat intelligence)

   The rule's references — CTI context to qualify the incident:

   • https://learn.microsoft.com/en-us/archive/blogs/msindiasupp/how-to-setup-and-collect-network-capture-using-network-monitor-tool
   • https://attack.mitre.org/techniques/T1040/