packet capture tool execution detector

drop prefetch shimcache or 4688 evtx csv · detect wireshark tshark and network capture tool execution · identify attacker network reconnaissance via packet capture · surface forensic vs attacker tool context · runs locally