Which SIEM platforms have a T1016.002 detection rule?

df00tech provides T1016.002 (Wi-Fi Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Wi-Fi Discovery (T1016.002)?

Detecting Wi-Fi Discovery requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1016.002 detection?

The T1016.002 detection is rated medium severity with high confidence.

What are common false positives for T1016.002?

Common false positives for T1016.002 include: IT administrators running netsh wlan show profiles or netsh wlan show profile key=clear for legitimate network troubleshooting or documentation purposes; Network monitoring or configuration management tools that enumerate Wi-Fi profiles as part of inventory collection (e.g., Lansweeper, PDQ Inventory, SCCM hardware inventory); Help desk or support technicians using netsh wlan commands to assist users with Wi-Fi connectivity issues.

T1016.002 IBM QRadar · QRadar

Detect Wi-Fi Discovery in IBM QRadar

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. On Windows, adversaries commonly use netsh wlan commands to enumerate saved Wi-Fi profiles and extract cleartext passwords. On Linux, Wi-Fi credentials may be found in /etc/NetworkManager/system-connections/. On macOS, the security command can retrieve Wi-Fi passwords. This technique is used by threat actors including Magic Hound (APT35), malware families such as Agent Tesla, CharmPower, PUBLOAD, Machete, and Emotet to support credential access, lateral movement to nearby wireless networks, and reconnaissance of the target environment.

MITRE ATT&CK

Tactic: Discovery
Technique: T1016 System Network Configuration Discovery
Sub-technique: T1016.002 Wi-Fi Discovery
Canonical reference: https://attack.mitre.org/techniques/T1016/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip AS SourceIP,
  username AS Username,
  "Process Name" AS ProcessName,
  "Process CommandLine" AS CommandLine,
  "Parent Process Path" AS ParentProcess,
  QIDNAME(qid) AS EventName
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 352)
  AND (
    LOWER("Process CommandLine") LIKE '%netsh%wlan%'
    OR LOWER("Process CommandLine") LIKE '%key=clear%'
    OR LOWER("Process CommandLine") LIKE '%wlan show profile%'
    OR LOWER("Process CommandLine") LIKE '%wlan show networks%'
    OR LOWER("Process CommandLine") LIKE '%wlan show interfaces%'
    OR LOWER("Process CommandLine") LIKE '%mode=bssid%'
    OR LOWER("Process CommandLine") LIKE '%networkmanager/system-connections%'
    OR LOWER("Process CommandLine") LIKE '%find-generic-password%'
  )
LAST 24 HOURS

medium severity medium confidence

Detects Wi-Fi Discovery (T1016.002) using IBM QRadar AQL against the events store. Targets Windows Security Event Log (LOGSOURCETYPEID=12) and Sysmon sources (LOGSOURCETYPEID=352) with normalized Process CommandLine custom properties. Requires the QRadar Windows Security DSM and either the Sysmon DSM or a Universal DSM parsing Sysmon EventCode 1 into the Process CommandLine custom property.

Data Sources

Microsoft Windows Security Event Log (QRadar DSM)Sysmon via Universal DSM or Sysmon DSMQRadar Log Source Extension for process telemetry

Required Tables

events

False Positives & Tuning

IT helpdesk staff executing netsh wlan commands manually or via remote management tools during wireless connectivity diagnostics on corporate workstations
Authorized network assessment or compliance scanning tools that enumerate saved Wi-Fi profiles as part of scheduled endpoint audits
Software deployment automation that exports and re-imports Wi-Fi profiles during OS migrations, device refresh cycles, or zero-touch provisioning workflows

Download portable Sigma rule (.yml)

Other platforms for T1016.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Enumerate All Saved Wi-Fi Profiles
Expected signal: Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine containing 'wlan show profiles'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the shell used to run the command (e.g., cmd.exe, powershell.exe).
Test 2Extract Wi-Fi Password in Cleartext
Expected signal: Sysmon Event ID 1: Two Process Create events — first for 'wlan show profiles', second with CommandLine containing 'wlan show profile' and 'key=clear'. Security Event ID 4688 for both executions. The second command is the highest-fidelity indicator.
Test 3Scan Nearby Wi-Fi Networks via netsh
Expected signal: Sysmon Event ID 1: Two Process Create events with Image=netsh.exe, first CommandLine containing 'wlan show networks mode=bssid', second containing 'wlan show interfaces'. Security Event ID 4688 for both. Output shows currently visible wireless access points.
Test 4Wi-Fi Discovery via PowerShell Invoking netsh
Expected signal: Sysmon Event ID 1: PowerShell process create, plus multiple netsh.exe child process creates with wlan arguments. Sysmon Event ID 11: File creation event for wifi_recon.txt in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 captures the full script. Parent-child relationship (powershell.exe → netsh.exe) is the key indicator.
Test 5Linux Wi-Fi Credential File Enumeration
Expected signal: Auditd syscall events for open/read of files under /etc/NetworkManager/system-connections/. Syslog entries for sudo usage. Process execution logs showing ls, grep, cat commands with /etc/NetworkManager/system-connections/ path arguments. On systems with auditd rule '-w /etc/NetworkManager/system-connections/ -p rwa -k wifi_cred_access', generates AUDIT_WATCH events.

Last updated: 2026-04-13 Research depth: deep

References (11)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1016.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Wi-Fi Discovery in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1016.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1016.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox