DETECTING WIFI DUMPING VIA DIRECT WINAPI CALLS AND INTRODUCTION TO IMMUTABLE ARTIFACTS

Summary from the TLDR InfoSec newsletter

Many detection rules rely on artifacts that are mutable by the attacker. This author sought to investigate detections that relied on immutable artifacts with the example of an attacker that enumerated WiFi networks and dumped passwords directly via the WinAPI as opposed to using tools such as netsh. The author initially ran into issues as the program they wrote to enumerate networks did not cause any obvious registry calls, spawn netsh, or read the Wlansvc\Profiles\Interfaces file. The only method that the author found to detect the attack was by enabling the noisy Sysmon Event ID 7 where a rule can be created by searching for an event where the ImageLoaded is wlanapi.dll and the Image contains an unfamiliar .exe.