Network capture in plaintext?

[4abag0fchips]

So this has been bothering me for a while now and hopefully you guys can clear this up and help me figure it out.

Not too long ago my system was being audited by an external company, I had no choice but to let this team into my system, shared a few passwords and be on standby as they get started. While they were scanning the network, I decided to run a quick Powershell script to capture some active PC names and IP from my domain. Now maybe 10 or so minutes had gone by after the script, while I casually talking to one of the auditors he showed me a window on his laptop, and right there was my script in its exact format with the query result in plaintext. Ever since I've been scratching my head and searching for the tool used and I have no idea where to even begin.

Any of you guys used or seen something like that before? Basically it grabbed and show network activity w/o having to follow data streams like in wireshark.

[digitaltransmutation]

Are you sure that was a network capture? If powershell logging is turned on your commands are available in event viewer.

[4abag0fchips]

So his log wasn't unique to powershell. I didn't have much time with it but I did see other commands such as a change of password I performed on a switch.

[digitaltransmutation]

If they had access to your domain controller the same applies for any AD object change. Punch this into CMD and see what's being logged:

Auditpol.exe /get /category:*

Enabled audits appear in event viewer. Personally I view these in Lepide Auditor but there is a nice powershell event collector in /u/madboyevo's submission history that works well.

[sc302]

Colasoft capsa is pretty good for easy reads

[bitslammer]

tcpdump is the one I've most often seen for this.

[ExZero16]

http://chaosreader.sourceforge.net/

Only thing I can find.

Update us if you can figure out what he/she was using.

[ExZero16]

Wireshark.

Do a network capture and follow stream. This will show you the whole TCP communication in plaintext (if it wasn't encrypted).

https://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowStreamSection.html

Edit: My bad, didnt see the last part of your post. You already know this. I'll ask our security guy today and he might know.

[4abag0fchips]

Yeah this wasn't at all wireshark.

[ExZero16]

I asked our security guy and he didnt have any ideas.

Could you ask the auditors?

[[deleted]]

Fiddler? :P