Wireless Credential Dumping using Netsh Command

  1[metadata]
  2creation_date = "2022/11/01"
  3integration = ["endpoint", "system", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = "Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh."
 10from = "now-9m"
 11index = [
 12    "endgame-*",
 13    "logs-crowdstrike.fdr*",
 14    "logs-endpoint.events.process-*",
 15    "logs-m365_defender.event-*",
 16    "logs-sentinel_one_cloud_funnel.*",
 17    "logs-system.security*",
 18    "logs-windows.forwarded*",
 19    "logs-windows.sysmon_operational-*",
 20    "winlogbeat-*",
 21]
 22language = "eql"
 23license = "Elastic License v2"
 24name = "Wireless Credential Dumping using Netsh Command"
 25references = [
 26    "https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts",
 27    "https://www.geeksforgeeks.org/how-to-find-the-wi-fi-password-using-cmd-in-windows/",
 28]
 29risk_score = 73
 30rule_id = "2de87d72-ee0c-43e2-b975-5f0b029ac600"
 31severity = "high"
 32tags = [
 33    "Domain: Endpoint",
 34    "OS: Windows",
 35    "Use Case: Threat Detection",
 36    "Tactic: Credential Access",
 37    "Tactic: Discovery",
 38    "Data Source: Elastic Endgame",
 39    "Resources: Investigation Guide",
 40    "Data Source: Elastic Defend",
 41    "Data Source: Windows Security Event Logs",
 42    "Data Source: Microsoft Defender XDR",
 43    "Data Source: Sysmon",
 44    "Data Source: SentinelOne",
 45    "Data Source: Crowdstrike",
 46    "Noise: Medium",
 47    "Performance: Normal",
 48    "Rule Type: Event Correlation (EQL)",
 49    "Platform: Windows",
 50]
 51timestamp_override = "event.ingested"
 52type = "eql"
 53
 54query = '''
 55process where host.os.type == "windows" and event.type == "start" and
 56 (process.name : "netsh.exe" or ?process.pe.original_file_name == "netsh.exe") and
 57  process.args : "wlan" and process.args : "key*clear"
 58'''
 59
 60note = """## Triage and analysis
 61
 62### Investigating Wireless Credential Dumping using Netsh Command
 63
 64#### Possible investigation steps
 65
 66- What did the alert-local netsh command expose or export?
 67  - Focus: `process.command_line`, `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`.
 68  - Implication: escalate when `key=clear` appears with bulk profile listing, `export profile`, omitted profile name, remote `-r`, script-file `-f`, or redirection; lower concern only when one local profile display fits recognized support or recovery. A signed Microsoft binary does not clear credential exposure.
 69
 70- Does the launcher, session, and user context explain why this account retrieved a wireless key on this host?
 71  - Focus: `process.parent.executable`, `process.parent.command_line`, `process.Ext.session_info.logon_type`, `user.id`, `host.id`.
 72  - Implication: escalate when the parent is a shell, script host, remote-admin chain, document-spawned process, unexpected service identity, or unusual device-support user; lower concern when an interactive support shell or endpoint-management parent on the same host explains the exact command.
 73
 74- Did the same launcher fan out from one display command into broader wireless-profile collection?
 75  - Why: attackers often enumerate profile names with `wlan show profiles`, then display or export cleartext secrets; same-launcher enumeration without `key=clear` is precursor discovery.
 76  - Focus: related process starts on `host.id` and `process.parent.entity_id`, using `process.executable` and `process.command_line`. $investigate_0
 77  - Implication: escalate when the parent also runs profile enumeration, repeated `show profile`, `export profile`, or export without `name=`; keep review local when activity stays isolated to one profile display.
 78  - Hint: If `process.parent.entity_id` is absent, pivot with `host.id`, `process.parent.pid`, and the alert window.
 79
 80- Did the launcher or siblings stage recovered wireless material?
 81  - Focus: same-parent process starts on `host.id`, using `process.executable` and `process.command_line`; file events from `host.id` plus `process.entity_id` or weaker `process.pid`, reviewing `file.path`, `file.extension`, and `file.size`. $investigate_1
 82  - Implication: escalate when XML, redirected text, ZIP files, copied profiles, archive tools, copy utilities, cloud-sync clients, shell redirection, or script wrappers stage material for later use or transfer; missing file telemetry is unresolved, not benign. A clean file view lowers concern only when command and lineage also stay limited.
 83
 84- If local evidence remains suspicious or unresolved, do related alerts change scope or urgency?
 85  - Focus: related alerts for `user.id`, especially credential-access, lateral-movement, staging, remote-access, or persistence findings. $investigate_2
 86  - Implication: broaden response when the same user or host also shows dumping, staging, remote access, or persistence; keep scope local when related alerts are absent and local evidence supports one bounded workflow.
 87  - Hint: If the user view is sparse or the host is shared, review alerts for the same `host.id`. $investigate_3
 88
 89- Escalate when command intent, lineage, same-launcher collection, staging, file artifacts, or related alerts show bulk credential access or broader compromise; close only when binary identity, command scope, parent workflow, user-host context, and recovery records bind to one recognized support or recovery action; preserve artifacts and escalate when evidence is mixed or incomplete.
 90
 91### False positive analysis
 92
 93- Helpdesk, field-support, device-recovery, imaging, hardware replacement, or Wi-Fi profile migration can retrieve one saved wireless key. Confirm signed netsh identity, one local profile display or expected export in `process.command_line`, support-tooling parentage, and no bulk enumeration, archive staging, or transfer; use asset or ticket records only to corroborate that exact action, otherwise require the same executable, parent, command pattern, `user.id`, `host.id`, and quiet surrounding activity across prior alerts from this rule.
 94- Before creating an exception, validate recurrence of the same `process.executable`, `process.parent.executable`, `process.command_line` pattern, `user.id`, and `host.id` with the same limited scope. Avoid exceptions on `process.name`, `key=clear` alone, the host alone, or all netsh wireless activity.
 95
 96### Response and remediation
 97
 98- If confirmed benign, reverse any temporary containment and document which evidence matched the support or recovery workflow: command scope, binary identity, parent workflow, `user.id`, `host.id`, and absence of collection or staging. Create an exception only after the same limited pattern recurs.
 99- If suspicious but unconfirmed, preserve the alert record, case export, volatile process context, `process.entity_id`, `process.command_line`, `process.parent.command_line`, sibling process starts, staged artifacts when recovered, and affected `user.id` and `host.id`. Start with reversible containment such as temporary wireless or network restrictions; use host isolation only if staging, export, transfer, or broader compromise is evident.
100- If confirmed malicious, isolate the endpoint or terminate the offending process through endpoint-response tooling after recording `process.entity_id`, `process.command_line`, parent context, exposed profile names, staged artifacts, and related-alert evidence. If tooling is unavailable, escalate with the preserved evidence set.
101- Reset or rotate credentials exposed by the dumped wireless profile. For PSK environments, rotate the affected SSID key; for 802.1X environments, revoke or reissue affected certificates, reset cached credentials, and verify whether the exposed profile could grant broader network access.
102- Before deleting artifacts, review other hosts and users for the same `process.command_line`, parent pattern, or exported profile artifacts so scoping finishes before evidence is destroyed.
103- Eradicate only scripts, batch files, XML exports, archives, and persistence mechanisms found during the investigation, then remediate the initial access path that allowed the key retrieval.
104"""
105
106setup = """## Setup
107
108This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
109
110Setup instructions: https://ela.st/install-elastic-defend
111
112### Additional data sources
113
114This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
115
116- [CrowdStrike](https://ela.st/crowdstrike-integration)
117- [Microsoft Defender XDR](https://ela.st/m365-defender)
118- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
119- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
120- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
121"""
122
123[rule.investigation_fields]
124field_names = [
125    "@timestamp",
126    "host.id",
127    "user.id",
128    "process.entity_id",
129    "process.pid",
130    "process.executable",
131    "process.command_line",
132    "process.args",
133    "process.pe.original_file_name",
134    "process.parent.entity_id",
135    "process.parent.pid",
136    "process.parent.executable",
137    "process.parent.command_line",
138    "process.code_signature.subject_name",
139    "process.code_signature.trusted",
140]
141
142[transform]
143
144[[transform.investigate]]
145label = "Process starts from the same parent"
146description = ""
147providers = [
148  [
149    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
150    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
151    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.parent.entity_id}}", valueType = "string" }
152  ]
153]
154relativeFrom = "now-1h"
155relativeTo = "now"
156
157[[transform.investigate]]
158label = "File activity for the alerting process"
159description = ""
160providers = [
161  [
162    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
163    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
164    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
165  ]
166]
167relativeFrom = "now-1h"
168relativeTo = "now"
169
170[[transform.investigate]]
171label = "Alerts associated with the user"
172description = ""
173providers = [
174  [
175    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
176    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
177  ]
178]
179relativeFrom = "now-48h/h"
180relativeTo = "now"
181
182[[transform.investigate]]
183label = "Alerts associated with the host"
184description = ""
185providers = [
186  [
187    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
188    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
189  ]
190]
191relativeFrom = "now-48h/h"
192relativeTo = "now"
193
194[[rule.threat]]
195framework = "MITRE ATT&CK"
196
197[[rule.threat.technique]]
198id = "T1003"
199name = "OS Credential Dumping"
200reference = "https://attack.mitre.org/techniques/T1003/"
201
202[[rule.threat.technique]]
203id = "T1552"
204name = "Unsecured Credentials"
205reference = "https://attack.mitre.org/techniques/T1552/"
206
207[[rule.threat.technique.subtechnique]]
208id = "T1552.001"
209name = "Credentials In Files"
210reference = "https://attack.mitre.org/techniques/T1552/001/"
211
212[[rule.threat.technique]]
213id = "T1555"
214name = "Credentials from Password Stores"
215reference = "https://attack.mitre.org/techniques/T1555/"
216
217[rule.threat.tactic]
218id = "TA0006"
219name = "Credential Access"
220reference = "https://attack.mitre.org/tactics/TA0006/"
221
222[[rule.threat]]
223framework = "MITRE ATT&CK"
224
225[[rule.threat.technique]]
226id = "T1016"
227name = "System Network Configuration Discovery"
228reference = "https://attack.mitre.org/techniques/T1016/"
229
230[[rule.threat.technique]]
231id = "T1082"
232name = "System Information Discovery"
233reference = "https://attack.mitre.org/techniques/T1082/"
234
235[rule.threat.tactic]
236id = "TA0007"
237name = "Discovery"
238reference = "https://attack.mitre.org/tactics/TA0007/"