An anomaly detection rule that flags the execution of common Windows network sniffing tools, such as dumpcap.exe, netcap.exe, netmon.exe, tcpdump.exe, tshark.exe, windump.exe, winpcap.exe, and wireshark.exe. The rule relies on endpoint telemetry from Sysmon Process Creation (Event ID 1), Windows Security event 4688 (New Process Creation), and CrowdStrike ProcessRollup2. When any of the listed tools is executed on Windows hosts, the detector triggers and surfaces contextual fields like the user, process details, parent process, and destination. This activity is significant because packet capture utilities enable attackers to intercept and analyze traffic for credential harvesting, data exfiltration, lateral movement, and reconnaissance. While such tools can be legitimately used for monitoring, their presence outside approved environments may indicate adversary activity (e.g., man-in-the-middle or data theft). The rule supports investigation by correlating with additional data such as the process name, path, hash, and host user. Implementation requires ingesting complete command lines and mapping telemetry to the Endpoint data model, normalized via CIM. True positives may include security testing on approved machines, so operational false positives should be mitigated by software inventories and documented admin activity. References and related content point toward MITRE techniques associated with credential access, discovery, exfiltration, and network surveillance (e.g., T1040).