Magic HoundG0059 ↗
Has collected names and passwords of all Wi-Fi networks to which a device has previously connected.1
tfMITRE ATT&CK sub-technique
Wi-Fi Discovery T1016.002
sub-technique of T1016 System Network Configuration Discovery
- Tactic
- Discovery
- Platforms
- Linux, Windows, macOS
- Version
- 1.1
- Created
- 08 September 2023
- Last modified
- 24 October 2025
- Contributors
- Alex Spivakovsky, Pentera; Christopher Peacock; Liran Ravich, CardinalOps; Uriel Kosayev
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Account Discovery, Remote System Discovery, and other discovery or Credential Access activity to support both ongoing and future campaigns.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.5
Tools & malware66th pct
Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Wi-Fi Discovery MITRE reference T1016.002
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
APT28 Nearest Neighbor CampaignC0051 ↗
During APT28 Nearest Neighbor Campaign, APT28 collected information on wireless interfaces within range of a compromised system.1
All 1 campaigns for this technique
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PUBLOADS1228 ↗
Has collected information on Wi-Fi networks from victim hosts leveraging netsh wlan show profiles, netsh wlan show interface, and netsh wlan show. 1
CharmPowerS0674 ↗
Can use netsh wlan show profiles to list specific Wi-Fi profile details.1
MacheteS0409 ↗
Uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.1
EmotetS0367 ↗
Can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.1
Agent TeslaS0331 ↗
Can collect names and passwords of all Wi-Fi networks to which a device has previously connected.1
All 5 software entries for this technique
Offense vs defense T1016.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Wi-Fi Discovery detection strategy DET0464
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Wi-Fi Discovery Activity
3 platforms
AN1280 · Windows
Enumeration of saved Wi-Fi profiles and cleartext password retrieval using netsh wlan or API-level access to wlanAPI.dll.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WiFiProfileName | Filter by known saved SSID names to reduce benign usage of network diagnostics |
| ParentProcess | Anomalous parent-child relationships may be used to spot abuse (e.g., Office → netsh) |
| TimeWindow | Correlate profile enumeration and password dumping within short timeframe (e.g., 60 seconds) |
AN1281 · Linux
File access to NetworkManager connection configs and attempts to read PSK credentials from /etc/NetworkManager/system-connections/*.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:EXECVE | execve |
| File AccessDC0055 | auditd:PATH | file read |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilenamePattern | Filter for filenames like *.nmconnection or profiles containing SSID names |
| UserContext | Distinguish between root/admin script usage vs. non-privileged terminal access |
AN1282 · macOS
Use of the security command or Keychain API to extract known Wi-Fi passwords for target SSIDs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WiFiNetworkFilter | Match suspicious SSIDs being queried via security find-generic-password -wa |
| ExecutionUser | Monitor root/admin usage of credential tools not linked to UI/system processes |
Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition