ChocoShell Fileless PowerShell Infostealer: Wi-Fi Credential Dump via netsh wlan key=clear
Detects fileless PowerShell execution that performs Wi-Fi credential dumping via netsh wlan key=clear, accesses browser credential stores, or reads SSO token cache (.tbres) files, consistent with ChocoShell infostealer activity.
Cortex XDR
