Detect Wi-Fi Discovery in Elastic Security
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. On Windows, adversaries commonly use netsh wlan commands to enumerate saved Wi-Fi profiles and extract cleartext passwords. On Linux, Wi-Fi credentials may be found in /etc/NetworkManager/system-connections/. On macOS, the security command can retrieve Wi-Fi passwords. This technique is used by threat actors including Magic Hound (APT35), malware families such as Agent Tesla, CharmPower, PUBLOAD, Machete, and Emotet to support credential access, lateral movement to nearby wireless networks, and reconnaissance of the target environment.
MITRE ATT&CK
- Tactic
- Discovery
- Sub-technique
- T1016.002 Wi-Fi Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1016/002/
Elastic Detection Query
process where event.type == "start" and (
(process.name : "netsh.exe" and process.command_line : "*wlan*") or
(process.command_line : ("*key=clear*", "*wlan show profile*", "*wlan show networks*", "*wlan show interfaces*", "*mode=bssid*", "*NetworkManager/system-connections*", "*find-generic-password*"))
)Detects Wi-Fi Discovery (T1016.002) using Elastic ECS process creation events. Matches netsh wlan subcommands for profile enumeration and password extraction (key=clear), macOS Keychain queries via the security binary, and Linux NetworkManager credential file access patterns. Compatible with Elastic Endpoint, Auditbeat, and Winlogbeat with Sysmon module.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators running netsh wlan show profiles interactively during routine wireless network troubleshooting or SSID inventory documentation on managed endpoints
- Enterprise MDM or deployment automation scripts (SCCM, Intune, Ansible) that enumerate or migrate Wi-Fi profiles as part of device provisioning or OS refresh workflows
- macOS MDM solutions (Jamf, Mosyle) or IT tooling that invoke the security binary for legitimate keychain and certificate management tasks unrelated to Wi-Fi credentials
Other platforms for T1016.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate All Saved Wi-Fi Profiles
Expected signal: Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine containing 'wlan show profiles'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the shell used to run the command (e.g., cmd.exe, powershell.exe).
- Test 2Extract Wi-Fi Password in Cleartext
Expected signal: Sysmon Event ID 1: Two Process Create events — first for 'wlan show profiles', second with CommandLine containing 'wlan show profile' and 'key=clear'. Security Event ID 4688 for both executions. The second command is the highest-fidelity indicator.
- Test 3Scan Nearby Wi-Fi Networks via netsh
Expected signal: Sysmon Event ID 1: Two Process Create events with Image=netsh.exe, first CommandLine containing 'wlan show networks mode=bssid', second containing 'wlan show interfaces'. Security Event ID 4688 for both. Output shows currently visible wireless access points.
- Test 4Wi-Fi Discovery via PowerShell Invoking netsh
Expected signal: Sysmon Event ID 1: PowerShell process create, plus multiple netsh.exe child process creates with wlan arguments. Sysmon Event ID 11: File creation event for wifi_recon.txt in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 captures the full script. Parent-child relationship (powershell.exe → netsh.exe) is the key indicator.
- Test 5Linux Wi-Fi Credential File Enumeration
Expected signal: Auditd syscall events for open/read of files under /etc/NetworkManager/system-connections/. Syslog entries for sudo usage. Process execution logs showing ls, grep, cat commands with /etc/NetworkManager/system-connections/ path arguments. On systems with auditd rule '-w /etc/NetworkManager/system-connections/ -p rwa -k wifi_cred_access', generates AUDIT_WATCH events.
References (11)
- https://attack.mitre.org/techniques/T1016/002/
- https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/
- https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/
- https://www.malwarebytes.com/blog/news/2020/04/new-agenttesla-variant-steals-wifi-credentials
- https://www.bleepingcomputer.com/news/security/hackers-steal-wifi-passwords-using-upgraded-agent-tesla-malware/
- https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/
- https://www.trendmicro.com/en_us/research/24/i/mustang-panda.html
- https://www.geeksforgeeks.org/wi-fi-password-connected-networks-windowslinux/
- https://mackeeper.com/blog/find-wi-fi-password-on-mac/
- https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016.002/T1016.002.md
Unlock Pro Content
Get the full detection package for T1016.002 including response playbook, investigation guide, and atomic red team tests.