Elastic high stable eql

Wireless Credential Dumping using Netsh Command

Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
 (process.name : "netsh.exe" or ?process.pe.original_file_name == "netsh.exe") and
  process.args : "wlan" and process.args : "key*clear"

Field Validations

Loading…

Comments (0)

Loading comments...