{"id":"T1016.002","name":"Wi-Fi Discovery","url":"https://attack.mitre.org/techniques/T1016/002","tactics":["discovery"],"platforms":["Linux","Windows","macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0464","stix_id":"x-mitre-detection-strategy--baea10fc-7921-4ae2-bfe6-572c3f107303","name":"Behavioral Detection of Wi-Fi Discovery Activity","url":"https://attack.mitre.org/detectionstrategies/DET0464","analytics":[{"id":"AN1280","stix_id":"x-mitre-analytic--8d58973f-7fd7-435e-86b8-58f9b399f89f","name":"Analytic 1280","description":"Enumeration of saved Wi-Fi profiles and cleartext password retrieval using `netsh wlan` or API-level access to `wlanAPI.dll`.","url":"https://attack.mitre.org/detectionstrategies/DET0464#AN1280","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"WiFiProfileName","description":"Filter by known saved SSID names to reduce benign usage of network diagnostics"},{"field":"ParentProcess","description":"Anomalous parent-child relationships may be used to spot abuse (e.g., Office → netsh)"},{"field":"TimeWindow","description":"Correlate profile enumeration and password dumping within short timeframe (e.g., 60 seconds)"}],"live":true,"detection_strategies":["DET0464"],"techniques":["T1016.002"]},{"id":"AN1281","stix_id":"x-mitre-analytic--1f3a6d61-9658-4c9b-92af-5c711206e3fa","name":"Analytic 1281","description":"File access to NetworkManager connection configs and attempts to read PSK credentials from `/etc/NetworkManager/system-connections/*`.","url":"https://attack.mitre.org/detectionstrategies/DET0464#AN1281","platforms":["Linux"],"log_source_references":[{"name":"auditd:PATH","channel":"file read","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-path"},{"name":"auditd:EXECVE","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"}],"mutable_elements":[{"field":"FilenamePattern","description":"Filter for filenames like *.nmconnection or profiles containing SSID names"},{"field":"UserContext","description":"Distinguish between root/admin script usage vs. non-privileged terminal access"}],"live":true,"detection_strategies":["DET0464"],"techniques":["T1016.002"]},{"id":"AN1282","stix_id":"x-mitre-analytic--ce2233bb-9715-4e7b-8603-7218f8bae326","name":"Analytic 1282","description":"Use of the `security` command or Keychain API to extract known Wi-Fi passwords for target SSIDs.","url":"https://attack.mitre.org/detectionstrategies/DET0464#AN1282","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"WiFiNetworkFilter","description":"Match suspicious SSIDs being queried via `security find-generic-password -wa`"},{"field":"ExecutionUser","description":"Monitor root/admin usage of credential tools not linked to UI/system processes"}],"live":true,"detection_strategies":["DET0464"],"techniques":["T1016.002"]}],"live":true,"version":"1.0","techniques":["T1016.002"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}