T1016.002 — Wi-Fi Discovery

Tactic: Discovery · Platforms: Linux, Windows, macOS

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Account Discovery, Remote System Discovery, and other discovery or Credential Access activity to support both ongoing and…

Sub-technique of System Network Configuration Discovery (T1016).

Sigma detection rules (3)

title: "T1016.002 System Network Configuration Discovery: Wi-Fi Discovery"
id: 857dee10-471e-4d0c-a19f-44a6e19e7231
description: 'Behavioral Detection of Wi-Fi Discovery Activity. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: WiFiProfileName, ParentProcess, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1016/002
author: Shahrukh Khan
date: 2026-06-29
license: MIT
tags:
  - attack.discovery
  - attack.t1016.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'wlan'
      - 'show'

  condition: selection

falsepositives:
  - IT staff and users troubleshooting Wi-Fi connectivity.

level: low

title: "T1016.002 System Network Configuration Discovery: Wi-Fi Discovery"
id: fa1aa912-0801-4fdc-b9e9-f2a470bd838a
description: 'Behavioral Detection of Wi-Fi Discovery Activity. (Retargeted to the process_creation auditd telemetry that actually captures this technique''s behavior; see logsource below.) Covers both active site-survey scans (nmcli/iwlist/iw scan) and the Linux-specific credential-harvesting behavior of reading stored network profiles under /etc/NetworkManager/system-connections/. Tune using: FilenamePattern, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1016/002
author: Shahrukh Khan
date: 2026-05-23
license: MIT
tags:
  - attack.discovery
  - attack.t1016.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_scan:
    type: EXECVE
    a0|endswith:
      - '/nmcli'
      - '/iwlist'
      - '/iw'
    a1|contains: 'scan'
  selection_creds:
    type: EXECVE
    a0|endswith:
      - '/cat'
      - '/grep'
      - '/cp'
      - '/less'
      - '/more'
      - '/head'
      - '/tail'
      - '/nano'
      - '/vim'
      - '/vi'
      - '/tar'
      - '/find'
    a1|contains: '/etc/NetworkManager/system-connections'

  condition: 1 of selection_*

falsepositives:
  - 'Legitimate Wi-Fi network management and troubleshooting on laptops/embedded devices; NetworkManager itself and configuration-management/backup tooling (e.g. etckeeper, ansible) routinely read files under /etc/NetworkManager/system-connections/, so scope UserContext away from root/service automation toward interactive non-admin sessions.'

level: medium

title: "T1016.002 System Network Configuration Discovery: Wi-Fi Discovery"
id: 8d66227b-8bc4-4c30-a634-11d0d933ce09
description: 'Behavioral Detection of Wi-Fi Discovery Activity. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WiFiNetworkFilter, ExecutionUser.'
references:
  - https://attack.mitre.org/techniques/T1016/002
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.discovery
  - attack.t1016.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/airport'
    CommandLine|contains: '-I'
  selection_alt:
    Image|endswith: '/networksetup'
    CommandLine|contains: '-listallhardwareports'
  condition: 1 of selection*

falsepositives:
  - Wi-Fi troubleshooting utilities or MDM inventory agents collecting network hardware details.

level: informational

Related sub-techniques

• T1016.001 Internet Connection Discovery

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1016.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan