Wi-Fi Network Profile Enumeration via Web Shell

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to enumerate Wi-Fi network profiles by looking for the command 'netsh wlan show' within HTTP URI requests. This activity is often associated with web shell usage, where an attacker has gained remote access to a web server and is using it to gather information about the underlying system's network configuration.