Catching Windows in the Act with Proxmox Packet Capture [YouTube Release]

UnpaidWorkerBot · July 8, 2026, 11:54pm

Additional Resources:

My VM Packet Capture

Capture_VM_Packets.sh

main

#!/usr/bin/env bash
#
# Capture_VM_Packets.sh in Proxmox 
# Starts a Proxmox VM and begins capturing on its tap interface the moment
# that interface appears, so you catch traffic from the earliest possible point.
#
# Usage: ./Capture_VM_Packets.sh <VMID> [output.pcap]
#   e.g. ./Capture_VM_Packets.sh 133 /root/test1.pcap

set -euo pipefail

VMID="${1:?Usage: $0 <VMID> [output.pcap]}"
OUTFILE="${2:-/root/gdid-clean-boot-${VMID}.pcap}"
TAP="tap${VMID}i0"
TIMEOUT=30   # seconds to wait for the tap to appear

# Make sure the VM is not already running (we want a clean boot).
if qm status "$VMID" | grep -q running; then
    echo "VM $VMID is already running. Stop it first for a clean-boot capture:"
    echo "    qm stop $VMID"

This file has been truncated. show original

Doug Burk So-Crates Github

My Security Onion Video

The previous video regarding the Threat Actor Arrest

Connect With Us

Hire Us for a project: Hire Us – Lawrence Systems
Toms’ Twitter Tom🌶\(^-^)/🌶 infosec.exchange/@tomlawrence (@TomLawrenceTech) / X
Our Website https://www.lawrencesystems.com/
Our Forums https://forums.lawrencesystems.com/
Instagram https://www.instagram.com/lawrencesystems/
Facebook https://www.facebook.com/Lawrencesystems/
GitHub lawrencesystems (Lawrence Systems) · GitHub

Lawrence Systems Shirts and Swag

► Lawrence Systems

AFFILIATES & REFERRAL LINKS

Amazon Affiliate Store
Lawrence Systems's Amazon Page

UniFi Affiliate Link
Ubiquiti Store

All Of Our Affiliates help us out and can get you discounts!
Partners We Love – Lawrence Systems

Gear we use on Kit
https://kit.co/lawrencesystems

Use OfferCode LTSERVICES to get 10% off your order at
Tech Supply Direct - Premium Refurbished Servers & Workstations at Unbeatable Prices

Digital Ocean Offer Code
AI-Native Cloud | DigitalOcean

HostiFi UniFi Cloud Hosting Service
HostiFi - Fast and Reliable UniFi in the Cloud

Protect your privacy with a VPN from Private Internet Access
https://www.privateinternetaccess.com/pages/buy-vpn/LRNSYS

Patreon
https://www.patreon.com/lawrencesystems

Chapters
0:00 The Hacker Windows Caught
0:26 The Experiment: Fresh Windows in Proxmox
0:40 Finding the VM Interface
1:27 Capturing with tcpdump
1:53 The Auto-Capture Script
3:11 Pulling the PCAP and Opening Wireshark
3:51 Filtering for SNI: Where Windows Phones Home
4:15 Easier Analysis with SO-CRATES
5:03 Reading the Results: DNS, HTTP, TLS
6:12 The EFF Shirt and Can You Block It?
7:51 Why I Trust Linux More
8:00 Wrap-Up

hs6666 · July 9, 2026, 6:28am

I just rerun elements of christitus’s powershell script after every windows update

A good brain dead quick “it’ll do” solution

svirepi · July 9, 2026, 7:42am

As Tom said, everything you do at OS level can be reverted later by windows update. There are several things you can do at network level, but thats also not a reliable solution because windows update can change network destinations as well, and get around whatever you have setup on your network. Just dont use windows.

RonV42 · July 9, 2026, 11:58am

Thanks Tom, I didn’t need to use proxmox to see the network flow I just did a filter in the flows in the Unifi dashboard and filtered on my Windows PC. I am also publishing flows to visualize them in GrayLog and have a nice dashboard setup.

Stiehl · July 10, 2026, 5:06pm

Anyone who is surprised by this has not been paying attention for the last decade or so.

I suppose you could block some of these domains from resolving at all, but I guarantee if you do that that a bunch of websites won’t work.

The better solution is to use an OS that doesn’t treat you like a product.

gaijin · July 10, 2026, 5:17pm

Without actual testimonials or reports such as this one, all pieces of information remains speculation. I therefore very much support and appreciate such journalism which uncovers the actual consequences of such data collection and @LTS_Tom for extending the awareness even further.