ZDI-26-898: Wireshark LoRaWAN Decryption Vulnerability — Detection and Mitigation Guide for Security Teams

---
title: Wireshark Process Spawning Unexpected Child Process
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects Wireshark or tshark spawning unexpected child processes, which may indicate successful exploitation of a dissector vulnerability such as ZDI-26-898.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-898/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msiexec.exe'
      - '\wmic.exe'
      - '\schtasks.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Wireshark extcap plugins that legitimately invoke scripts
  - Custom dissector development environments
level: high
---
title: Tshark or Dumpcap Execution from Unusual Parent Process
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects tshark or dumpcap being invoked by a parent process other than Wireshark GUI, which may indicate post-exploitation use of packet capture tools or lateral movement.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-898/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.discovery
  - attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\tshark.exe'
      - '\dumpcap.exe'
  filter_legitimate:
    ParentImage|endswith:
      - '\wireshark.exe'
      - '\explorer.exe'
      - '\cmd.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Automated network monitoring scripts
  - CI/CD pipeline network validation
level: medium
---
title: Suspicious Capture File Dropped in User Directory
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects creation of packet capture files in user directories by non-Wireshark processes, which may indicate delivery of a crafted capture file designed to exploit ZDI-26-898.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-898/
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.initial_access
  - attack.t1566
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.pcap'
      - '.pcapng'
      - '.cap'
  filter_legitimate:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
      - '\tcpdump.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Network management tools exporting capture files
  - SIEM agents collecting network artifacts
level: medium

// Hunt for Wireshark/tshark spawning suspicious child processes
// Relevant to ZDI-26-898 exploitation detection
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe", "wmic.exe", "schtasks.exe", "net.exe", "curl.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("wireshark.exe", "tshark.exe", "dumpcap.exe")
| where FileName has_any (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, FolderPath
| order by TimeGenerated desc

// Hunt for tshark/dumpcap spawning shells or interpreters on Linux
// Requires Syslog ingestion into Sentinel
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("tshark", "dumpcap", "wireshark")
| where SyslogMessage has_any ("bash", "sh -c", "python", "perl", "nc ", "ncat", "socat", "wget", "curl")
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt for Wireshark/tshark processes with suspicious child processes
-- Relevant to ZDI-26-898 post-exploitation detection

LET wireshark_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)wireshark|tshark|dumpcap'

LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM wireshark_procs)
  AND Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bash|sh|python|perl'

SELECT Pid AS ChildPid,
       Ppid AS ParentPid,
       Name AS ChildName,
       Exe AS ChildPath,
       CommandLine AS ChildCmdLine,
       Username AS ChildUser,
       CreateTime AS ChildStartTime
FROM suspicious_children

#Requires -RunAsAdministrator
# ZDI-26-898: Wireshark LoRaWAN Decryption Vulnerability Audit Script
# Run on endpoints to identify at-risk Wireshark installations

Write-Host "[+] ZDI-26-898 Wireshark LoRaWAN Vulnerability Audit" -ForegroundColor Cyan
Write-Host "=======================================================" -ForegroundColor Cyan

# Check for Wireshark installation
$wiresharkPaths = @(
    "$env:ProgramFiles\Wireshark\wireshark.exe",
    "${env:ProgramFiles(x86)}\Wireshark\wireshark.exe"
)

$wiresharkInstalled = $false
$wiresharkVersion = $null

foreach ($path in $wiresharkPaths) {
    if (Test-Path $path) {
        $wiresharkInstalled = $true
        $fileInfo = Get-Item $path
        $wiresharkVersion = $fileInfo.VersionInfo.ProductVersion
        Write-Host "`n[!] Wireshark found: $path" -ForegroundColor Yellow
        Write-Host "    Version: $wiresharkVersion" -ForegroundColor Yellow
        break
    }
}

if (-not $wiresharkInstalled) {
    Write-Host "`n[+] Wireshark not detected on this system." -ForegroundColor Green
    exit 0
}

# Check for LoRaWAN decryption configuration in preferences
$prefPaths = @(
    "$env:APPDATA\Wireshark\preferences",
    "$env:APPDATA\Wireshark\profiles\*\preferences"
)

$lorawanFound = $false

foreach ($prefPath in $prefPaths) {
    $files = Get-ChildItem -Path $prefPath -ErrorAction SilentlyContinue
    foreach ($file in $files) {
        $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
        if ($content -match 'lorawan') {
            Write-Host "`n[!] LoRaWAN configuration found in: $($file.FullName)" -ForegroundColor Red
            $lorawanLines = ($content -split "`n") | Where-Object { $_ -match 'lorawan' }
            foreach ($line in $lorawanLines) {
                Write-Host "    $($line.Trim())" -ForegroundColor Red
            }
            $lorawanFound = $true
        }
    }
}

if (-not $lorawanFound) {
    Write-Host "`n[+] No LoRaWAN decryption configuration detected in preferences." -ForegroundColor Green
} else {
    Write-Host "`n[!] ACTION REQUIRED: LoRaWAN decryption is configured on this system." -ForegroundColor Red
    Write-Host "    This system is potentially vulnerable to ZDI-26-898." -ForegroundColor Red
    Write-Host "    Mitigation steps:" -ForegroundColor Yellow
    Write-Host "      1. Update Wireshark to the latest patched version immediately." -ForegroundColor Yellow
    Write-Host "      2. If patching is not possible, disable LoRaWAN decryption:" -ForegroundColor Yellow
    Write-Host "         Edit > Preferences > Protocols > LoRaWAN > Uncheck decryption options" -ForegroundColor Yellow
    Write-Host "      3. Avoid opening untrusted capture files until patched." -ForegroundColor Yellow
}

# Check for running Wireshark processes
$wiresharkProcs = Get-Process -Name "wireshark","tshark","dumpcap" -ErrorAction SilentlyContinue
if ($wiresharkProcs) {
    Write-Host "`n[!] Wireshark processes currently running:" -ForegroundColor Yellow
    foreach ($proc in $wiresharkProcs) {
        Write-Host "    $($proc.ProcessName) (PID: $($proc.Id)) - Started: $($proc.StartTime)" -ForegroundColor Yellow
    }
}

Write-Host "`n[+] Audit complete." -ForegroundColor Cyan

#!/usr/bin/env bash
# ZDI-26-898: Wireshark LoRaWAN Vulnerability Audit for Linux
# Checks for Wireshark/tshark installation and LoRaWAN decryption configuration

echo "[+] ZDI-26-898 Wireshark LoRaWAN Vulnerability Audit"
echo "======================================================="

# Check for tshark/wireshark installation
if command -v tshark &>/dev/null; then
    TSHARK_VERSION=$(tshark --version 2>/dev/null | head -1)
    echo ""
    echo "[!] tshark found: $(which tshark)"
    echo "    Version: $TSHARK_VERSION"
else
    echo "[+] tshark not detected on this system."
    exit 0
fi

if command -v wireshark &>/dev/null; then
    echo "[!] wireshark GUI found: $(which wireshark)"
fi

# Check user preference files for LoRaWAN configuration
FOUND=0
for userhome in /root /home/*; do
    PREF_FILE="$userhome/.config/wireshark/preferences"
    if [ -f "$PREF_FILE" ]; then
        LORAWAN_LINES=$(grep -i 'lorawan' "$PREF_FILE" 2>/dev/null)
        if [ -n "$LORAWAN_LINES" ]; then
            echo ""
            echo "[!] LoRaWAN configuration found in: $PREF_FILE"
            echo "$LORAWAN_LINES" | while IFS= read -r line; do
                echo "    $line"
            done
            FOUND=1
        fi
    fi
done

if [ "$FOUND" -eq 0 ]; then
    echo ""
    echo "[+] No LoRaWAN decryption configuration detected."
else
    echo ""
    echo "[!] ACTION REQUIRED: LoRaWAN decryption is configured."
    echo "    Update Wireshark to the latest patched version immediately."
    echo "    If patching is not possible, remove or comment out LoRaWAN"
    echo "    key/decryption entries from the preferences file."
fi

echo ""
echo "[+] Audit complete."