Harvesting Of Wifi Credentials Via Netsh.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•38

This rule detects attempts to harvest Wi-Fi credentials using the `netsh.exe` utility. Specifically, it looks for `netsh.exe` execution with command-line arguments that indicate an attempt to display WLAN profiles and their keys in clear text, which is a common technique used by malware like Agent Tesla to steal Wi-Fi passwords.