Capture Network Packets on the windows 10 with October 2018 Update or later.
pktmon.exe start --etw
Will start a packet capture and store log file as PktMon.etl. Use pktmon.exe stop
use this a built in network sniffer on windows 10 to capture senstive traffic
c:\windows\system32\pktmon.exe, c:\windows\syswow64\pktmon.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_pktmon.yml, IOC: .etl files found on system
Derek Johnson