Merge pull request #102 from mattiasborg82/master

Create wifikeys.txt
microsoft · Apr 22, 2020 · ff5a9e7 · ff5a9e7
2 parents 434dc39 + 35a3d6e
commit ff5a9e7
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/General queries/wifikeys.txt b/General queries/wifikeys.txt
@@ -0,0 +1,9 @@
+// List commands the exposed WIFI Keys
+// @mattiasborg82
+// blog.sec-labs.com
+DeviceProcessEvents 
+| where Timestamp > ago(7d)
+| where ProcessCommandLine startswith "netsh.exe"
+| where ProcessCommandLine has "key=clear"
+| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
+| top 100 by Timestamp