APT28G0007 ↗
Has exploited open Wi-Fi access points for initial access to target devices using the network.12
tfMITRE ATT&CK technique
Wi-Fi Networks T1669
- Tactic
- Initial Access
- Platforms
- Linux, Network Devices, Windows, macOS
- Version
- 1.0
- Created
- 25 February 2025
- Last modified
- 15 April 2025
- Contributors
- Cian Heasley; Menachem Goldstein
Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks — requiring Valid Accounts — belonging to a target organization.[1][2] Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Wi-Fi Networks MITRE reference T1669
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
APT28 Nearest Neighbor CampaignC0051 ↗
During APT28 Nearest Neighbor Campaign, APT28 established wireless connections to secure, enterprise Wi-Fi networks belonging to a target organization for initial access into the environment.1
All 1 campaigns for this technique
Offense vs defense T1669
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Wi-Fi Networks detection strategy DET0536
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Wi-Fi Networks
4 platforms
AN1476 · Windows
Detects anomalous wireless connections such as unexpected SSID associations, failed or repeated authentication attempts, and connections outside of known geofenced networks. Defenders should monitor wireless connection logs and event codes for network discovery, authentication, and association events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | WinEventLog:Security | EventCode=4776, 4625 |
| Network Connection CreationDC0082 | WinEventLog:Microsoft-Windows-WLAN-AutoConfig | EventCode=8001, 8002, 8003 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KnownSSIDList | Defines approved Wi-Fi SSIDs for the environment; deviations may indicate malicious connection attempts. |
| GeoLocationContext | Correlates expected physical location of systems with observed Wi-Fi connections to detect anomalies. |
AN1477 · Linux
Detects unauthorized wireless associations by monitoring wpa_supplicant logs, NetworkManager events, and system calls related to interface state changes. Anomalies include repeated association failures, new SSIDs outside baselined values, and rogue AP connections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | auditd:SYSCALL | ioctl: Changes to wireless network interfaces (up, down, reassociate) |
| Network Connection CreationDC0082 | linux:syslog | New Wi-Fi connection established or repeated association failures |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedSSIDRegex | Regex-based whitelist of corporate SSIDs; anomalous matches indicate suspicious activity. |
| RetryThreshold | Number of failed association attempts allowed before triggering detection. |
AN1478 · macOS
Detects unauthorized Wi-Fi associations and SSID scanning activity using unified logs and airport command telemetry. Anomalies include rapid SSID switching, connections to unapproved SSIDs, or repeated authentication failures.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | macos:osquery | query: Historical list of associated SSIDs compared against baseline |
| Network Connection CreationDC0082 | macos:unifiedlog | Association and authentication events including failures and new SSIDs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BaselineSSIDHistory | Historical record of corporate SSID associations per device; deviations may indicate rogue AP usage. |
AN1479 · Network Devices
Detects rogue or suspicious wireless access attempts by monitoring firewall, WIDS/WIPS, and controller logs. Focus is on firewall rule changes, rogue AP detection, and anomalous MAC addresses connecting to access points.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Firewall Rule ModificationDC0051 | NSM:Firewall | rule_modification: New or modified firewall rules related to wireless interfaces |
| Network Traffic ContentDC0085 | WIDS:AssociationLogs | Unauthorized AP or anomalous MAC address connection attempts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedAPList | Defines known access points and MAC addresses; deviations highlight rogue or unauthorized devices. |
Ensure that all wired and/or wireless traffic is encrypted appropriately. Use best practices for authentication protocols, such as Kerberos, and ensure that web traffic that may contain credentials is protected by SSL/TLS.
Harden access requirements for Wi-Fi networks through using two or more pieces of evidence to authenticate, such as a username and password in addition to a token from a physical smart card or token generator.
Network SegmentationM1030
Network segmentation can be used to isolate infrastructure components that do not require broad network access. Separate networking environments for Wi-Fi and Ethernet-wired networks, particularly where Ethernet-based networks allow for access to sensitive resources.