Raw socket promiscuous mode sniffing (SIO_RCVALL) via ERAAgent.exe

Seb Cantar@sebcantar

•updated Aug 27, 2026•2•0•6

Detects the ERAAgent.exe process creating raw sockets (SOCK_RAW) and enabling promiscuous mode (SIO_RCVALL) on a non-loopback interface while lacking corresponding listening port activity. This behavior is indicative of passive magic-packet sniffing, often associated with the SLEEPWALKER backdoor/trojan.