ChocoShell Wi-Fi credential harvesting via netsh key=clear (redirected output, excl. remote-support tools)
Detects the use of netsh.exe to export Wi-Fi profiles with clear-text keys using output redirection or piping. This behavior is indicative of automated credential harvesting, such as that observed in the CaptiveCrunch campaign, while filtering out legitimate interactive usage and known remote support tools.
Microsoft Sentinel (KQL)
