Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
4
3
2
1
1
Contributors
3
2
1
1
1
Categories
6
6
6
2
1
Platforms
10
2
Products / Services
3
3
2
2
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
1
1
IDS Protocols
2
Detects the enumeration of Wi-Fi profiles followed by the extraction of clear-text credentials for those profiles using the Windows 'netsh wlan' command. This pattern is commonly observed during post-exploitation activities to retrieve stored Wi-Fi passwords.
Detects the use of the 'netsh wlan show profile' command with the 'key=clear' argument, which is used to display the plaintext passwords of stored WiFi profiles on a Windows system.
Generic rule content from file: Translated CQL Rule
Detects the use of netsh.exe to export Wi-Fi profiles with clear-text keys using output redirection or piping. This behavior is indicative of automated credential harvesting, such as that observed in the CaptiveCrunch campaign, while filtering out legitimate interactive usage and known remote support tools.
Detects the use of the netsh.exe utility with the 'wlan show profile' command and the 'key=clear' argument, which displays saved Wi-Fi network passwords in plaintext. This technique is often used by adversaries to perform credential harvesting on compromised systems.
Detects Enumerating Stored Wi-Fi Profiles And Passwords via netsh (System Network Configuration Discovery: Wi-Fi Discovery) using command-line and process indicators derived from executor behavior.
Detects enumeration of Wi-Fi networks and saved profiles
This rule detects attempts to exfiltrate wireless network lists (SSIDs) over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "SSID" (case-insensitive). This activity is indicative of a trojan attempting to steal network information.
This rule detects attempts to enumerate Wi-Fi network profiles by looking for the command 'netsh wlan show' within HTTP URI requests. This activity is often associated with web shell usage, where an attacker has gained remote access to a web server and is using it to gather information about the underlying system's network configuration.
wifikeys
KQL
Detect if someone run netsh and try to expose WPA keys in clear text
@mattiasborg82.
Blog.sec-labs.com.
@mattiasborg82.
Blog.sec-labs.com.
This rule detects attempts to harvest Wi-Fi credentials using the `netsh.exe` utility. Specifically, it looks for `netsh.exe` execution with command-line arguments that indicate an attempt to display WLAN profiles and their keys in clear text, which is a common technique used by malware like Agent Tesla to steal Wi-Fi passwords.
