Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting

title: Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting
id: 20f7119e-9e81-4a2c-b3f3-818af11dc674
status: test
description: This rule flags process executions of netsh.exe where the command line includes the WLAN context and an option consistent with clearing keys. Such activity matters because it can be used to access, manipulate, or export stored wireless credential material from the local host. Detection relies on Windows process creation telemetry capturing the executed binary image and the full command line string.
references:
  - https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml
author: Andreas Hunkeler (@Karneades), oscd.community, Huntrule Team
date: 2020-04-20
modified: 2023-02-13
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - wlan
      - " s"
      - " p"
      - " k"
      - =clear
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 42b1a5b8-353f-4f10-b256-39de4467faff
    type: derived