Which SIEM platforms have a T1016.002 detection rule?

df00tech provides T1016.002 (Wi-Fi Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Wi-Fi Discovery (T1016.002)?

Detecting Wi-Fi Discovery requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1016.002 detection?

The T1016.002 detection is rated medium severity with high confidence.

What are common false positives for T1016.002?

Common false positives for T1016.002 include: IT administrators running netsh wlan show profiles or netsh wlan show profile key=clear for legitimate network troubleshooting or documentation purposes; Network monitoring or configuration management tools that enumerate Wi-Fi profiles as part of inventory collection (e.g., Lansweeper, PDQ Inventory, SCCM hardware inventory); Help desk or support technicians using netsh wlan commands to assist users with Wi-Fi connectivity issues.

T1016.002 Google Chronicle · YARA-L

Detect Wi-Fi Discovery in Google Chronicle

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. On Windows, adversaries commonly use netsh wlan commands to enumerate saved Wi-Fi profiles and extract cleartext passwords. On Linux, Wi-Fi credentials may be found in /etc/NetworkManager/system-connections/. On macOS, the security command can retrieve Wi-Fi passwords. This technique is used by threat actors including Magic Hound (APT35), malware families such as Agent Tesla, CharmPower, PUBLOAD, Machete, and Emotet to support credential access, lateral movement to nearby wireless networks, and reconnaissance of the target environment.

MITRE ATT&CK

Tactic: Discovery
Technique: T1016 System Network Configuration Discovery
Sub-technique: T1016.002 Wi-Fi Discovery
Canonical reference: https://attack.mitre.org/techniques/T1016/002/

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

rule wifi_discovery_t1016_002 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Wi-Fi Discovery (T1016.002) via netsh wlan profile enumeration and key=clear password extraction on Windows, security binary Keychain queries on macOS, and NetworkManager credential file access on Linux"
    severity = "MEDIUM"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1016.002"
    reference = "https://attack.mitre.org/techniques/T1016/002/"
    platforms = "Windows, macOS, Linux"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.command_line, `(?i)netsh\s+\S*\s*wlan`) or
      re.regex($e.target.process.command_line, `(?i)wlan\s+show\s+profiles?`) or
      re.regex($e.target.process.command_line, `(?i)wlan\s+show\s+networks?`) or
      re.regex($e.target.process.command_line, `(?i)wlan\s+show\s+interfaces?`) or
      re.regex($e.target.process.command_line, `(?i)key=clear`) or
      re.regex($e.target.process.command_line, `(?i)mode=bssid`) or
      re.regex($e.target.process.command_line, `NetworkManager/system-connections`) or
      re.regex($e.target.process.command_line, `find-generic-password`)
    )

  condition:
    $e
}

medium severity high confidence

Chronicle YARA-L 2.0 rule detecting Wi-Fi Discovery (T1016.002) across Windows, macOS, and Linux platforms using UDM PROCESS_LAUNCH events. Uses re.regex() for case-insensitive matching against target.process.command_line UDM field. Covers netsh wlan enumeration subcommands, key=clear plaintext credential extraction, macOS security binary Keychain queries, and Linux NetworkManager system-connections directory access. Compatible with Chronicle forwarders for Windows Event Logs, Sysmon, macOS endpoint telemetry, and Linux auditd.

Data Sources

Google Chronicle SIEM (UDM)Windows Event Logs via Chronicle ForwarderSysmon via Chronicle ForwardermacOS Endpoint Security Framework telemetry via ChronicleLinux auditd via Chronicle Forwarder

Required Tables

UDM Events (metadata.event_type = PROCESS_LAUNCH)

False Positives & Tuning

IT operations staff running netsh wlan show profiles for wireless network documentation, SSID inventory, or troubleshooting during scheduled maintenance windows
Authorized red team or penetration testing exercises that include wireless reconnaissance as explicitly defined in the rules of engagement
macOS MDM tools (Jamf Pro, Mosyle, Kandji) executing the security binary for legitimate certificate lifecycle management, keychain provisioning, or password rotation workflows

Download portable Sigma rule (.yml)

Other platforms for T1016.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Enumerate All Saved Wi-Fi Profiles
Expected signal: Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine containing 'wlan show profiles'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the shell used to run the command (e.g., cmd.exe, powershell.exe).
Test 2Extract Wi-Fi Password in Cleartext
Expected signal: Sysmon Event ID 1: Two Process Create events — first for 'wlan show profiles', second with CommandLine containing 'wlan show profile' and 'key=clear'. Security Event ID 4688 for both executions. The second command is the highest-fidelity indicator.
Test 3Scan Nearby Wi-Fi Networks via netsh
Expected signal: Sysmon Event ID 1: Two Process Create events with Image=netsh.exe, first CommandLine containing 'wlan show networks mode=bssid', second containing 'wlan show interfaces'. Security Event ID 4688 for both. Output shows currently visible wireless access points.
Test 4Wi-Fi Discovery via PowerShell Invoking netsh
Expected signal: Sysmon Event ID 1: PowerShell process create, plus multiple netsh.exe child process creates with wlan arguments. Sysmon Event ID 11: File creation event for wifi_recon.txt in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 captures the full script. Parent-child relationship (powershell.exe → netsh.exe) is the key indicator.
Test 5Linux Wi-Fi Credential File Enumeration
Expected signal: Auditd syscall events for open/read of files under /etc/NetworkManager/system-connections/. Syslog entries for sudo usage. Process execution logs showing ls, grep, cat commands with /etc/NetworkManager/system-connections/ path arguments. On systems with auditd rule '-w /etc/NetworkManager/system-connections/ -p rwa -k wifi_cred_access', generates AUDIT_WATCH events.

Last updated: 2026-04-13 Research depth: deep

References (11)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1016.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Wi-Fi Discovery in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1016.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1016.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox