Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting
Detects netsh.exe command-line activity targeting WLAN and clearing keys, indicative of potential WiFi credential harvesting on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Andreas Hunkeler (@Karneades), oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-04-20
- Updated
- 2026-07-30
ATT&CK techniques
Cred Access → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of netsh.exe where the command line includes the WLAN context and an option consistent with clearing keys. Such activity matters because it can be used to access, manipulate, or export stored wireless credential material from the local host. Detection relies on Windows process creation telemetry capturing the executed binary image and the full command line string.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting
id: 20f7119e-9e81-4a2c-b3f3-818af11dc674
status: test
description: This rule flags process executions of netsh.exe where the command line includes the WLAN context and an option consistent with clearing keys. Such activity matters because it can be used to access, manipulate, or export stored wireless credential material from the local host. Detection relies on Windows process creation telemetry capturing the executed binary image and the full command line string.
references:
- https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml
author: Andreas Hunkeler (@Karneades), oscd.community, Huntrule Team
date: 2020-04-20
modified: 2023-02-13
tags:
- attack.discovery
- attack.credential-access
- attack.t1040
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \netsh.exe
- OriginalFileName: netsh.exe
selection_cli:
CommandLine|contains|all:
- wlan
- " s"
- " p"
- " k"
- =clear
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 42b1a5b8-353f-4f10-b256-39de4467faff
type: derived