diff --git a/atomics/T1016.002/T1016.002.yaml b/atomics/T1016.002/T1016.002.yaml new file mode 100644 index 00000000..b07b04bc --- /dev/null +++ b/atomics/T1016.002/T1016.002.yaml @@ -0,0 +1,13 @@ +attack_technique: T1016.002 +display_name: "System Network Configuration Discovery: Wi-Fi Discovery" +atomic_tests: +- name: Enumerate Stored Wi-Fi Profiles And Passwords via netsh + auto_generated_guid: + description: Upon successful execution, information about previously connected Wi-Fi networks will be displayed with their corresponding key (if present). + supported_platforms: + - windows + executor: + command: netsh wlan show profile * key=clear + cleanup_command: + name: command_prompt + elevation_required: false