wifikeys

Description

Detect if someone run netsh and try to expose WPA keys in clear text @mattiasborg82. Blog.sec-labs.com.

Query · kql

DeviceProcessEvents 
| where Timestamp > ago(7d)
| where ProcessCommandLine startswith "netsh"
| where ProcessCommandLine has "key=clear"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| top 100 by Timestamp
Raw source wifikeys · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ad5c7f75-95e0-4eb9-93e5-b1793ef405d6
name: wifikeys
description: |
  Detect if someone run netsh and try to expose WPA keys in clear text
  @mattiasborg82.
  Blog.sec-labs.com.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  | where ProcessCommandLine startswith "netsh"
  | where ProcessCommandLine has "key=clear"
  | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
  | top 100 by Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.