Wi-Fi Discovery

let WiFiDiscoveryPatterns = dynamic([
  "wlan show profiles",
  "wlan show profile",
  "wlan show networks",
  "wlan show interfaces",
  "wlan show",
  "key=clear",
  "wlanAPI",
  "NetworkManager/system-connections",
  "find-generic-password"
]);
let WiFiExecutables = dynamic(["netsh.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh", "security"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    // Direct netsh wlan commands
    (FileName =~ "netsh.exe" and ProcessCommandLine has "wlan")
    // PowerShell or cmd calling netsh wlan
    or (ProcessCommandLine has "netsh" and ProcessCommandLine has "wlan")
    // Reading NM connection files on Linux via WSL or scripting
    or (ProcessCommandLine has "NetworkManager" and ProcessCommandLine has "system-connections")
    // macOS security command for Wi-Fi passwords
    or (ProcessCommandLine has "find-generic-password" and ProcessCommandLine has "-wa")
    // key=clear to extract plaintext Wi-Fi password
    or (ProcessCommandLine has "key=clear")
  )
| extend IsProfileEnum = ProcessCommandLine has "show profiles"
| extend IsPasswordExtract = ProcessCommandLine has "key=clear"
| extend IsNetworkScan = ProcessCommandLine has_any ("show networks", "show interfaces", "mode=bssid")
| extend IsMacOSQuery = ProcessCommandLine has "find-generic-password"
| extend IsLinuxQuery = ProcessCommandLine has "system-connections"
| extend SuspicionScore = toint(IsProfileEnum) + toint(IsPasswordExtract) + toint(IsNetworkScan) + toint(IsMacOSQuery) + toint(IsLinuxQuery)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName,
         IsProfileEnum, IsPasswordExtract, IsNetworkScan, IsMacOSQuery, IsLinuxQuery,
         SuspicionScore
| sort by Timestamp desc

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
  (
    (Image="*\\netsh.exe" CommandLine="*wlan*")
    OR (CommandLine="*netsh*" CommandLine="*wlan*")
    OR (CommandLine="*key=clear*")
    OR (CommandLine="*wlan show profiles*")
    OR (CommandLine="*wlan show profile*")
    OR (CommandLine="*wlan show networks*")
    OR (CommandLine="*wlan show interfaces*")
    OR (CommandLine="*mode=bssid*")
  )
| eval IsProfileEnum=if(match(CommandLine, "wlan show profiles?"), 1, 0)
| eval IsPasswordExtract=if(match(CommandLine, "key=clear"), 1, 0)
| eval IsNetworkScan=if(match(CommandLine, "(show networks|show interfaces|mode=bssid)"), 1, 0)
| eval IsParentSuspicious=if(match(ParentImage, "(powershell|wscript|cscript|mshta|cmd)"), 1, 0)
| eval SuspicionScore=IsProfileEnum + IsPasswordExtract + IsNetworkScan + IsParentSuspicious
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        IsProfileEnum, IsPasswordExtract, IsNetworkScan, IsParentSuspicious, SuspicionScore
| sort - SuspicionScore, - _time

process where event.type == "start" and (
  (process.name : "netsh.exe" and process.command_line : "*wlan*") or
  (process.command_line : ("*key=clear*", "*wlan show profile*", "*wlan show networks*", "*wlan show interfaces*", "*mode=bssid*", "*NetworkManager/system-connections*", "*find-generic-password*"))
)

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip AS SourceIP,
  username AS Username,
  "Process Name" AS ProcessName,
  "Process CommandLine" AS CommandLine,
  "Parent Process Path" AS ParentProcess,
  QIDNAME(qid) AS EventName
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 352)
  AND (
    LOWER("Process CommandLine") LIKE '%netsh%wlan%'
    OR LOWER("Process CommandLine") LIKE '%key=clear%'
    OR LOWER("Process CommandLine") LIKE '%wlan show profile%'
    OR LOWER("Process CommandLine") LIKE '%wlan show networks%'
    OR LOWER("Process CommandLine") LIKE '%wlan show interfaces%'
    OR LOWER("Process CommandLine") LIKE '%mode=bssid%'
    OR LOWER("Process CommandLine") LIKE '%networkmanager/system-connections%'
    OR LOWER("Process CommandLine") LIKE '%find-generic-password%'
  )
LAST 24 HOURS

_index=sec_record_processCreation
| where commandLine matches "*netsh*wlan*"
  OR commandLine matches "*key=clear*"
  OR commandLine matches "*wlan show profile*"
  OR commandLine matches "*wlan show networks*"
  OR commandLine matches "*wlan show interfaces*"
  OR commandLine matches "*mode=bssid*"
  OR commandLine matches "*NetworkManager*system-connections*"
  OR commandLine matches "*find-generic-password*"
| eval IsProfileEnum = if(commandLine matches "*wlan show profile*", 1, 0)
| eval IsPasswordExtract = if(commandLine matches "*key=clear*", 1, 0)
| eval IsNetworkScan = if(commandLine matches "*show networks*" OR commandLine matches "*show interfaces*" OR commandLine matches "*mode=bssid*", 1, 0)
| eval IsParentSuspicious = if(parentBaseImage matches "*(powershell*" OR parentBaseImage matches "*cmd.exe*" OR parentBaseImage matches "*wscript*" OR parentBaseImage matches "*cscript*" OR parentBaseImage matches "*mshta*", 1, 0)
| eval SuspicionScore = IsProfileEnum + IsPasswordExtract + IsNetworkScan + IsParentSuspicious
| fields _messageTime, device_hostname, user_username, baseImage, commandLine, parentBaseImage, IsProfileEnum, IsPasswordExtract, IsNetworkScan, IsParentSuspicious, SuspicionScore
| sort by SuspicionScore desc, _messageTime desc

rule wifi_discovery_t1016_002 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Wi-Fi Discovery (T1016.002) via netsh wlan profile enumeration and key=clear password extraction on Windows, security binary Keychain queries on macOS, and NetworkManager credential file access on Linux"
    severity = "MEDIUM"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1016.002"
    reference = "https://attack.mitre.org/techniques/T1016/002/"
    platforms = "Windows, macOS, Linux"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.command_line, `(?i)netsh\s+\S*\s*wlan`) or
      re.regex($e.target.process.command_line, `(?i)wlan\s+show\s+profiles?`) or
      re.regex($e.target.process.command_line, `(?i)wlan\s+show\s+networks?`) or
      re.regex($e.target.process.command_line, `(?i)wlan\s+show\s+interfaces?`) or
      re.regex($e.target.process.command_line, `(?i)key=clear`) or
      re.regex($e.target.process.command_line, `(?i)mode=bssid`) or
      re.regex($e.target.process.command_line, `NetworkManager/system-connections`) or
      re.regex($e.target.process.command_line, `find-generic-password`)
    )

  condition:
    $e
}

#event_simpleName = ProcessRollup2
| CommandLine = /(?i)(netsh.*wlan|wlan\s+show\s+profiles?|wlan\s+show\s+networks?|wlan\s+show\s+interfaces?|key=clear|mode=bssid|NetworkManager.*system-connections|find-generic-password)/
| IsProfileEnum := if(CommandLine = /(?i)wlan\s+show\s+profiles?/, 1, 0)
| IsPasswordExtract := if(CommandLine = /(?i)key=clear/, 1, 0)
| IsNetworkScan := if(CommandLine = /(?i)(show\s+networks?|show\s+interfaces?|mode=bssid)/, 1, 0)
| IsMacOSQuery := if(CommandLine = /find-generic-password/, 1, 0)
| IsLinuxQuery := if(CommandLine = /NetworkManager.*system-connections/, 1, 0)
| SuspicionScore := IsProfileEnum + IsPasswordExtract + IsNetworkScan + IsMacOSQuery + IsLinuxQuery
| table([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, IsProfileEnum, IsPasswordExtract, IsNetworkScan, IsMacOSQuery, IsLinuxQuery, SuspicionScore])
| sort(SuspicionScore, order=desc)