Saved wireless profiles enumerated or exported in cleartext

Siemphony@siemphonymediumT1016.002unverifiedPlaybook · Discovery and enumeration

AN1280 describes two things: enumerating the wireless profiles a host has saved, and pulling their pre-shared keys back out in cleartext. Both are driven from the command line through netsh's wlan context, so this rule requires the wlan token and one of the profile, export, network-listing or key=clear actions in the same command line; the pair is what separates discovery from the wireless diagnostics that share the binary. `show interfaces` and `show drivers` are deliberately excluded — they report the adapter's current state, carry neither a profile list nor a key, and are the first commands support staff type at any connectivity complaint. The other half of the analytic, wlanAPI.dll called directly from code, leaves no command line behind and is invisible here, so a quiet result is not evidence that nothing enumerated the wireless profiles. The logic is written in the Sysmon EventID 1 vocabulary the brief names for this category; the brief's other source, the PowerShell 4103/4104 channel, needs Script Block Logging enabled and a different field mapping, and if this category is fed from Security 4688 instead that channel needs Audit Process Creation plus the separate Include command line in process creation events policy — without it CommandLine is empty and the rule cannot match at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0464, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Saved wireless profiles enumerated or exported in cleartext2id: a7735f02-c3a9-4da7-be01-47a4cdc43dd53status: experimental4description: |5  AN1280 describes two things: enumerating the wireless profiles a host has saved,6  and pulling their pre-shared keys back out in cleartext. Both are driven from7  the command line through netsh's wlan context, so this rule requires the wlan8  token and one of the profile, export, network-listing or key=clear actions in9  the same command line; the pair is what separates discovery from the wireless10  diagnostics that share the binary. `show interfaces` and `show drivers` are11  deliberately excluded — they report the adapter's current state, carry neither a12  profile list nor a key, and are the first commands support staff type at any13  connectivity complaint. The other half of the analytic, wlanAPI.dll called14  directly from code, leaves no command line behind and is invisible here, so a15  quiet result is not evidence that nothing enumerated the wireless profiles. The16  logic is written in the Sysmon EventID 1 vocabulary the brief names for this17  category; the brief's other source, the PowerShell 4103/4104 channel, needs18  Script Block Logging enabled and a different field mapping, and if this category19  is fed from Security 4688 instead that channel needs Audit Process Creation plus20  the separate Include command line in process creation events policy — without21  it CommandLine is empty and the rule cannot match at all.22  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0464, not hand-written and not tested by its author. Any lab result is on this rule's own page.23references:24  - https://attack.mitre.org/techniques/T1016/00225  - https://attack.mitre.org/detectionstrategies/DET046426author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)27date: 2026-08-1628tags:29  - attack.discovery30  - attack.t1016.00231logsource:32  category: process_creation33  product: windows34detection:35  selection_wlan_context:36    CommandLine|contains: 'wlan '37  selection_action:38    CommandLine|contains:39      - 'show profile'40      - 'show networks'41      - 'export profile'42      - 'key=clear'43  condition: selection_wlan_context and selection_action44falsepositives:45  - "Wireless troubleshooting by helpdesk staff or by an automated diagnostic script, where netsh wlan show profiles is run to check which networks a laptop has saved before rebuilding a connection. On a mobile fleet this is the highest-volume benign match and is what the level below reflects."46  - "Asset inventory and endpoint management agents that collect the saved SSID list from every portable machine on a schedule, to report which corporate, guest and home networks a laptop has joined."47  - "Provisioning, imaging and onboarding scripts that call netsh wlan export profile with key=clear on a reference machine and re-import the resulting XML during a build, which uses the cleartext key by design."48  - "Wireless site-survey and roaming diagnostics tooling that calls netsh wlan show networks mode=bssid repeatedly while an engineer measures coverage, producing a burst of matches from one host over a short period."49level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "wlan " and (ProcessCommandLine contains "show profile" or ProcessCommandLine contains "show networks" or ProcessCommandLine contains "export profile" or ProcessCommandLine contains "key=clear"))

Splunk · SPL

Run this as a search.

index=* (CommandLine="*wlan *" AND (CommandLine="*show profile*" OR CommandLine="*show networks*" OR CommandLine="*export profile*" OR CommandLine="*key=clear*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*wlan *" AND (TO_LOWER(process.command_line) LIKE "*show profile*" OR TO_LOWER(process.command_line) LIKE "*show networks*" OR TO_LOWER(process.command_line) LIKE "*export profile*" OR TO_LOWER(process.command_line) LIKE "*key=clear*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)wlan </field>    <field name="CommandLine" type="pcre2">(?i)(show profile|show networks|export profile|key=clear)</field>    <description>Saved wireless profiles enumerated or exported in cleartext</description>    <mitre>      <id>T1016.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a7735f02-c3a9-4da7-be01-47a4cdc43dd5

ATT&CKT1016.002

T1016.002Wi-Fi Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1016.002, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Filter the inventory agents on a single ParentImage field, which keeps the
Add the abbreviated forms (sh pro, exp pro) to selection_action, or OR in
Drop show networks first if the site-survey burst dominates; it is also the
MITRE's knobs here are WiFiProfileName (suppress known corporate SSIDs),
The real blind spot is wlanAPI.dll called from code, which leaves no command

Declared by the author

Wireless troubleshooting by helpdesk staff or by an automated diagnostic script, where netsh wlan show profiles is run to check which networks a laptop has saved before rebuilding a connection. On a mobile fleet this is the highest-volume benign match and is what the level below reflects.
Asset inventory and endpoint management agents that collect the saved SSID list from every portable machine on a schedule, to report which corporate, guest and home networks a laptop has joined.
Provisioning, imaging and onboarding scripts that call netsh wlan export profile with key=clear on a reference machine and re-import the resulting XML during a build, which uses the cleartext key by design.
Wireless site-survey and roaming diagnostics tooling that calls netsh wlan show networks mode=bssid repeatedly while an engineer measures coverage, producing a burst of matches from one host over a short period.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

A process creation whose command line enters netsh's wlan context and asks it for saved wireless profiles, exports them, or requests their pre-shared keys in cleartext. AN1280 describes exactly those two behaviours — enumerating saved profiles, and pulling the keys back out — and both are driven from the command line.

02 · Telemetry you need

category: process_creation / product: windows, copied from the brief. The rule is written in the Sysmon EventID 1 vocabulary, which matters: if you feed this category from Security 4688 instead, you need Audit Process Creation plus the separate Include command line in process creation events policy. Neither is on by default or in the MS/CIS baselines, and without the second one CommandLine is empty and the rule cannot match at all.
The brief's other source, PowerShell 4103/4104, needs Script Block Logging and a different field mapping, so it is not covered here.

03 · How the logic works

Two selections, AND-ed. selection_wlan_context is CommandLine|contains: 'wlan ' — the context token, with a trailing space so it does not collide with substrings. selection_action is CommandLine|contains over four alternatives: show profile, show networks, export profile, key=clear. The pair is what separates discovery from ordinary wireless diagnostics that share the binary. show interfaces and show drivers are excluded on purpose — they report adapter state, carry neither a profile nor a key, and are the first thing support staff type. Two things the reviewer surfaced that a deployer should know before trusting it. First, netsh resolves any unambiguous prefix, so netsh wlan sh pro key=cl does the analytic's job and matches none of the four action tokens — a bypass costing four keystrokes. The context token survives abbreviation; the action half does not. Second, show networks lists visible beacons and touches no saved profile, so it sits inside the technique but outside AN1280. There is no Image gate, which catches a renamed netsh but means a shell-wrapped run (cmd.exe /c netsh wlan show profiles) alerts twice.

04 · Common false positives

Helpdesk and automated diagnostic scripts running netsh wlan show profiles before rebuilding a connection — on a mobile fleet, the highest-volume human source. Asset-inventory and endpoint-management agents collecting the saved SSID list from every laptop on a schedule, which is one guaranteed match per machine per cycle. Provisioning and imaging scripts that use export profile with key=clear by design. Site-survey tooling calling show networks mode=bssid in bursts. The reviewer added Windows' own network troubleshooter, which shells out to these commands under sdiagnhost.exe when a user clicks Diagnose.
The rule ships level: medium, and the reviewer's calibration finding is that scheduled inventory makes low the honest value unless you filter those agents first.

05 · Detection maturity

tier_1: , and it remains there until it has been run against real data. UNVERIFIED — derived from DET0464 and never executed against a log line.
tier_2: is a week of process creation filtered to netsh, ranked by parent process, which yields both the exclusion list and the true level.

Share this rule

/u/siemphony/a7735f02-c3a9-4da7-be01-47a4cdc43dd5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Saved wireless profiles enumerated or exported in cleartext

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it