Detect Wi-Fi Discovery in CrowdStrike LogScale
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. On Windows, adversaries commonly use netsh wlan commands to enumerate saved Wi-Fi profiles and extract cleartext passwords. On Linux, Wi-Fi credentials may be found in /etc/NetworkManager/system-connections/. On macOS, the security command can retrieve Wi-Fi passwords. This technique is used by threat actors including Magic Hound (APT35), malware families such as Agent Tesla, CharmPower, PUBLOAD, Machete, and Emotet to support credential access, lateral movement to nearby wireless networks, and reconnaissance of the target environment.
MITRE ATT&CK
- Tactic
- Discovery
- Sub-technique
- T1016.002 Wi-Fi Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1016/002/
LogScale Detection Query
#event_simpleName = ProcessRollup2
| CommandLine = /(?i)(netsh.*wlan|wlan\s+show\s+profiles?|wlan\s+show\s+networks?|wlan\s+show\s+interfaces?|key=clear|mode=bssid|NetworkManager.*system-connections|find-generic-password)/
| IsProfileEnum := if(CommandLine = /(?i)wlan\s+show\s+profiles?/, 1, 0)
| IsPasswordExtract := if(CommandLine = /(?i)key=clear/, 1, 0)
| IsNetworkScan := if(CommandLine = /(?i)(show\s+networks?|show\s+interfaces?|mode=bssid)/, 1, 0)
| IsMacOSQuery := if(CommandLine = /find-generic-password/, 1, 0)
| IsLinuxQuery := if(CommandLine = /NetworkManager.*system-connections/, 1, 0)
| SuspicionScore := IsProfileEnum + IsPasswordExtract + IsNetworkScan + IsMacOSQuery + IsLinuxQuery
| table([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, IsProfileEnum, IsPasswordExtract, IsNetworkScan, IsMacOSQuery, IsLinuxQuery, SuspicionScore])
| sort(SuspicionScore, order=desc)Detects Wi-Fi Discovery (T1016.002) using CrowdStrike Falcon LogScale (CQL) on ProcessRollup2 sensor events. Applies a multi-dimensional suspicion scoring model covering Windows netsh wlan profile and password enumeration, network scanning subcommands, macOS Keychain queries via the security binary, and Linux NetworkManager credential file access. Requires Falcon sensor deployed on Windows, macOS, or Linux endpoints with process telemetry enabled.
Data Sources
Required Tables
False Positives & Tuning
- Corporate IT scripts using netsh wlan for automated Wi-Fi profile export, backup, or migration during device refresh or OS upgrade procedures managed through endpoint tooling
- Network operations center staff executing netsh wlan commands manually or via remote shells for wireless infrastructure diagnostics on corporate-managed hosts
- Internal security team running wireless vulnerability assessments or Wi-Fi auditing tools on authorized systems as part of scheduled penetration testing or compliance checks
Other platforms for T1016.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate All Saved Wi-Fi Profiles
Expected signal: Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine containing 'wlan show profiles'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the shell used to run the command (e.g., cmd.exe, powershell.exe).
- Test 2Extract Wi-Fi Password in Cleartext
Expected signal: Sysmon Event ID 1: Two Process Create events — first for 'wlan show profiles', second with CommandLine containing 'wlan show profile' and 'key=clear'. Security Event ID 4688 for both executions. The second command is the highest-fidelity indicator.
- Test 3Scan Nearby Wi-Fi Networks via netsh
Expected signal: Sysmon Event ID 1: Two Process Create events with Image=netsh.exe, first CommandLine containing 'wlan show networks mode=bssid', second containing 'wlan show interfaces'. Security Event ID 4688 for both. Output shows currently visible wireless access points.
- Test 4Wi-Fi Discovery via PowerShell Invoking netsh
Expected signal: Sysmon Event ID 1: PowerShell process create, plus multiple netsh.exe child process creates with wlan arguments. Sysmon Event ID 11: File creation event for wifi_recon.txt in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 captures the full script. Parent-child relationship (powershell.exe → netsh.exe) is the key indicator.
- Test 5Linux Wi-Fi Credential File Enumeration
Expected signal: Auditd syscall events for open/read of files under /etc/NetworkManager/system-connections/. Syslog entries for sudo usage. Process execution logs showing ls, grep, cat commands with /etc/NetworkManager/system-connections/ path arguments. On systems with auditd rule '-w /etc/NetworkManager/system-connections/ -p rwa -k wifi_cred_access', generates AUDIT_WATCH events.
References (11)
- https://attack.mitre.org/techniques/T1016/002/
- https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/
- https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/
- https://www.malwarebytes.com/blog/news/2020/04/new-agenttesla-variant-steals-wifi-credentials
- https://www.bleepingcomputer.com/news/security/hackers-steal-wifi-passwords-using-upgraded-agent-tesla-malware/
- https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/
- https://www.trendmicro.com/en_us/research/24/i/mustang-panda.html
- https://www.geeksforgeeks.org/wi-fi-password-connected-networks-windowslinux/
- https://mackeeper.com/blog/find-wi-fi-password-on-mac/
- https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016.002/T1016.002.md
Unlock Pro Content
Get the full detection package for T1016.002 including response playbook, investigation guide, and atomic red team tests.