Which SIEM platforms have a T1016.002 detection rule?

df00tech provides T1016.002 (Wi-Fi Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1016.002 detection?

The T1016.002 detection is rated medium severity with high confidence.

What are common false positives for T1016.002?

Common false positives for T1016.002 include: IT administrators running netsh wlan show profiles or netsh wlan show profile key=clear for legitimate network troubleshooting or documentation purposes; Network monitoring or configuration management tools that enumerate Wi-Fi profiles as part of inventory collection (e.g., Lansweeper, PDQ Inventory, SCCM hardware inventory); Help desk or support technicians using netsh wlan commands to assist users with Wi-Fi connectivity issues.

T1016.002 Splunk · SPL

Detect Wi-Fi Discovery in Splunk

Q: What data sources are required to detect Wi-Fi Discovery (T1016.002)?

Detecting Wi-Fi Discovery requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. On Windows, adversaries commonly use netsh wlan commands to enumerate saved Wi-Fi profiles and extract cleartext passwords. On Linux, Wi-Fi credentials may be found in /etc/NetworkManager/system-connections/. On macOS, the security command can retrieve Wi-Fi passwords. This technique is used by threat actors including Magic Hound (APT35), malware families such as Agent Tesla, CharmPower, PUBLOAD, Machete, and Emotet to support credential access, lateral movement to nearby wireless networks, and reconnaissance of the target environment.

MITRE ATT&CK

Tactic: Discovery
Technique: T1016 System Network Configuration Discovery
Sub-technique: T1016.002 Wi-Fi Discovery
Canonical reference: https://attack.mitre.org/techniques/T1016/002/

SPL Detection Query

Splunk (SPL)

spl

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
  (
    (Image="*\\netsh.exe" CommandLine="*wlan*")
    OR (CommandLine="*netsh*" CommandLine="*wlan*")
    OR (CommandLine="*key=clear*")
    OR (CommandLine="*wlan show profiles*")
    OR (CommandLine="*wlan show profile*")
    OR (CommandLine="*wlan show networks*")
    OR (CommandLine="*wlan show interfaces*")
    OR (CommandLine="*mode=bssid*")
  )
| eval IsProfileEnum=if(match(CommandLine, "wlan show profiles?"), 1, 0)
| eval IsPasswordExtract=if(match(CommandLine, "key=clear"), 1, 0)
| eval IsNetworkScan=if(match(CommandLine, "(show networks|show interfaces|mode=bssid)"), 1, 0)
| eval IsParentSuspicious=if(match(ParentImage, "(powershell|wscript|cscript|mshta|cmd)"), 1, 0)
| eval SuspicionScore=IsProfileEnum + IsPasswordExtract + IsNetworkScan + IsParentSuspicious
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        IsProfileEnum, IsPasswordExtract, IsNetworkScan, IsParentSuspicious, SuspicionScore
| sort - SuspicionScore, - _time

medium severity high confidence

Detects Wi-Fi discovery commands using Sysmon Event ID 1 (Process Creation). Searches for netsh.exe invocations with wlan-related arguments, including profile enumeration, cleartext password extraction (key=clear), nearby network scanning (mode=bssid), and interface enumeration. Assigns a suspicion score based on command line content and parent process context. Higher scores indicate more deliberate enumeration activity typical of malware such as Agent Tesla, CharmPower, PUBLOAD, and Machete.

Data Sources

Process: Process CreationCommand: Command ExecutionSysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

IT administrators running netsh wlan show profiles or netsh wlan show profile key=clear for legitimate network troubleshooting or documentation purposes
Network monitoring or configuration management tools that enumerate Wi-Fi profiles as part of inventory collection (e.g., Lansweeper, PDQ Inventory, SCCM hardware inventory)
Help desk or support technicians using netsh wlan commands to assist users with Wi-Fi connectivity issues
Automated onboarding or device provisioning scripts that query existing Wi-Fi profiles before deploying new connection configurations

Download portable Sigma rule (.yml)

Other platforms for T1016.002

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Enumerate All Saved Wi-Fi Profiles
Expected signal: Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine containing 'wlan show profiles'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the shell used to run the command (e.g., cmd.exe, powershell.exe).
Test 2Extract Wi-Fi Password in Cleartext
Expected signal: Sysmon Event ID 1: Two Process Create events — first for 'wlan show profiles', second with CommandLine containing 'wlan show profile' and 'key=clear'. Security Event ID 4688 for both executions. The second command is the highest-fidelity indicator.
Test 3Scan Nearby Wi-Fi Networks via netsh
Expected signal: Sysmon Event ID 1: Two Process Create events with Image=netsh.exe, first CommandLine containing 'wlan show networks mode=bssid', second containing 'wlan show interfaces'. Security Event ID 4688 for both. Output shows currently visible wireless access points.
Test 4Wi-Fi Discovery via PowerShell Invoking netsh
Expected signal: Sysmon Event ID 1: PowerShell process create, plus multiple netsh.exe child process creates with wlan arguments. Sysmon Event ID 11: File creation event for wifi_recon.txt in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 captures the full script. Parent-child relationship (powershell.exe → netsh.exe) is the key indicator.
Test 5Linux Wi-Fi Credential File Enumeration
Expected signal: Auditd syscall events for open/read of files under /etc/NetworkManager/system-connections/. Syslog entries for sudo usage. Process execution logs showing ls, grep, cat commands with /etc/NetworkManager/system-connections/ path arguments. On systems with auditd rule '-w /etc/NetworkManager/system-connections/ -p rwa -k wifi_cred_access', generates AUDIT_WATCH events.

Last updated: 2026-04-13 Research depth: deep

References (11)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1016.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Wi-Fi Discovery in Splunk

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1016.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1016.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox