T1669 — Wi-Fi Networks

Tactic: Initial Access · Platforms: Linux, Network Devices, Windows, macOS

Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks — requiring Valid Accounts — belonging to a target organization. Establishing a…

Sigma detection rules (4)

T1669 Wi-Fi Networks

title: T1669 Wi-Fi Networks
id: d4370cfb-89ae-4b8f-8047-09bec0287063
description: 'Detects Wi-Fi network connection/profile commands issued via netsh.exe (netsh wlan connect / netsh wlan add profile), the Windows-observable proxy for wireless network association since native WLAN-AutoConfig operational connection events are not enabled by default in most environments and fall outside standard Sysmon/Security telemetry. Retargeted from generic EventID 4776/4625 authentication events, which carry no wireless-adapter or SSID signal. (Data Component: Command Execution; baseline tier: windows-eventid.) Tune using: KnownSSIDList, GeoLocationContext.'
references:
  - https://attack.mitre.org/techniques/T1669
author: Shahrukh Khan
date: 2026-06-25
license: MIT
tags:
  - attack.initial-access
  - attack.t1669

logsource:
  category: process_creation
  product: windows

detection:
  selection_connect:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'wlan'
      - 'connect'

  selection_add_profile:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'wlan'
      - 'add'
      - 'profile'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_connect or selection_add_profile) and not filter_system_account

falsepositives:
  - Routine end-user Wi-Fi connections and IT-deployed WLAN profile scripts will also match; correlate with KnownSSIDList and GeoLocationContext (unexpected SSID or a host connecting far from its normal location) to isolate rogue-AP or unauthorized-network use. System and service accounts are excluded via filter_system_account.

level: medium

T1669 Wi-Fi Networks

title: T1669 Wi-Fi Networks
id: e899e03b-c1bb-4060-803f-19146e7b93a1
description: 'Detection Strategy for Wi-Fi Networks. Raw auditd has no native SSID/802.11 association fields - the prior version required syscall=connect together with exe=dhclient, which only observes routine DHCP lease negotiation, identical on wired interfaces and normal Wi-Fi reconnects alike, and could not distinguish a new/unexpected wireless association from everyday DHCP renewal. Retargeted to wpa_supplicant/NetworkManager syslog output, which logs actual SSID association events (CTRL-EVENT-CONNECTED, "Successfully activated") - the genuine Linux-observable signal for establishing a new Wi-Fi connection. Tune using: AllowedSSIDRegex, RetryThreshold.'
references:
  - https://attack.mitre.org/techniques/T1669
author: Shahrukh Khan
date: 2026-01-01
license: MIT
tags:
  - attack.initial-access
  - attack.t1669

logsource:
  product: linux
  service: syslog

detection:
  selection_wpa_connect:
    Message|contains: 'CTRL-EVENT-CONNECTED'
  selection_nm_activate:
    Message|contains:
      - 'NetworkManager'
      - 'Successfully activated'

  condition: 1 of selection_*

falsepositives:
  - Legitimate, routine reconnection to an already-trusted home/office Wi-Fi network after sleep/roaming; scope AllowedSSIDRegex to the organization's approved SSID list so only connections to unrecognized networks alert.

level: low

T1669 Wi-Fi Networks

title: T1669 Wi-Fi Networks
id: c2d87b8b-1107-48c1-9fc4-e9a61f607e38
description: 'Detection Strategy for Wi-Fi Networks. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BaselineSSIDHistory.'
references:
  - https://attack.mitre.org/techniques/T1669
author: Shahrukh Khan
date: 2026-04-30
license: MIT
tags:
  - attack.initial-access
  - attack.t1669

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith: '/airport'
    CommandLine|contains: '-A'

  condition: selection

falsepositives:
  - Unified log network_connection events do not expose the associated Wi-Fi SSID or BSSID directly, so this rule can only catch manual use of the airport command line utility to join a network and will miss automatic association to a rogue access point entirely.

level: medium

T1669 Wi-Fi Networks

title: T1669 Wi-Fi Networks
id: 452b1cae-92e9-457c-8012-84880421ed4e
description: 'Detection Strategy for Wi-Fi Networks. (Data Component: Firewall Rule Modification; baseline tier: fallback.) Tune using: AuthorizedAPList.'
references:
  - https://attack.mitre.org/techniques/T1669
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.initial-access
  - attack.t1669

logsource:
  product: nsm
  service: firewall

detection:
  selection_new_rule:
    action: 'allow'
    rule_name|contains:
      - 'guest-ap'
      - 'rogue'
      - 'unmanaged'
  condition: selection_new_rule

falsepositives:
  - Newly provisioned and properly authorized guest wireless access points, before their rule name is normalized in change management, will also match.

level: medium

Explore