AN1280
Analytic 1280
Windows
Enumeration of saved Wi-Fi profiles and cleartext password retrieval using `netsh wlan` or API-level access to `wlanAPI.dll`.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[WiFiProfileName]
Filter by known saved SSID names to reduce benign usage of network diagnostics
[ParentProcess]
Anomalous parent-child relationships may be used to spot abuse (e.g., Office → netsh)
[TimeWindow]
Correlate profile enumeration and password dumping within short timeframe (e.g., 60 seconds)
AN1281
Analytic 1281
Linux
File access to NetworkManager connection configs and attempts to read PSK credentials from `/etc/NetworkManager/system-connections/*`.
auditd:PATH
file read
auditd:EXECVE
execve
[FilenamePattern]
Filter for filenames like *.nmconnection or profiles containing SSID names
[UserContext]
Distinguish between root/admin script usage vs. non-privileged terminal access
AN1282
Analytic 1282
macOS
Use of the `security` command or Keychain API to extract known Wi-Fi passwords for target SSIDs.
macos:unifiedlog
process
[WiFiNetworkFilter]
Match suspicious SSIDs being queried via `security find-generic-password -wa`
[ExecutionUser]
Monitor root/admin usage of credential tools not linked to UI/system processes