WiFi Password Dumping Detection

This query detects attempts to dump WiFi passwords in plain text from cmd

Detection Query

//This query detects attempts to dump WiFi passwords in plain text from cmd
//Note: This action does NOT require admin privileges
DeviceProcessEvents
| where FileName == "netsh.exe"
| where ProcessCommandLine contains "key=clear" //plain-text

Tags