Detect Wi-Fi Discovery in Sumo Logic CSE
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. On Windows, adversaries commonly use netsh wlan commands to enumerate saved Wi-Fi profiles and extract cleartext passwords. On Linux, Wi-Fi credentials may be found in /etc/NetworkManager/system-connections/. On macOS, the security command can retrieve Wi-Fi passwords. This technique is used by threat actors including Magic Hound (APT35), malware families such as Agent Tesla, CharmPower, PUBLOAD, Machete, and Emotet to support credential access, lateral movement to nearby wireless networks, and reconnaissance of the target environment.
MITRE ATT&CK
- Tactic
- Discovery
- Sub-technique
- T1016.002 Wi-Fi Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1016/002/
Sumo Detection Query
_index=sec_record_processCreation
| where commandLine matches "*netsh*wlan*"
OR commandLine matches "*key=clear*"
OR commandLine matches "*wlan show profile*"
OR commandLine matches "*wlan show networks*"
OR commandLine matches "*wlan show interfaces*"
OR commandLine matches "*mode=bssid*"
OR commandLine matches "*NetworkManager*system-connections*"
OR commandLine matches "*find-generic-password*"
| eval IsProfileEnum = if(commandLine matches "*wlan show profile*", 1, 0)
| eval IsPasswordExtract = if(commandLine matches "*key=clear*", 1, 0)
| eval IsNetworkScan = if(commandLine matches "*show networks*" OR commandLine matches "*show interfaces*" OR commandLine matches "*mode=bssid*", 1, 0)
| eval IsParentSuspicious = if(parentBaseImage matches "*(powershell*" OR parentBaseImage matches "*cmd.exe*" OR parentBaseImage matches "*wscript*" OR parentBaseImage matches "*cscript*" OR parentBaseImage matches "*mshta*", 1, 0)
| eval SuspicionScore = IsProfileEnum + IsPasswordExtract + IsNetworkScan + IsParentSuspicious
| fields _messageTime, device_hostname, user_username, baseImage, commandLine, parentBaseImage, IsProfileEnum, IsPasswordExtract, IsNetworkScan, IsParentSuspicious, SuspicionScore
| sort by SuspicionScore desc, _messageTime descDetects Wi-Fi Discovery (T1016.002) using Sumo Logic CSE normalized process creation records. Applies a suspicion scoring model across profile enumeration, plaintext password extraction, network scanning subcommands, and suspicious parent process ancestry to surface high-confidence credential theft activity. Requires Sumo Logic Cloud SIEM Enterprise with Windows or endpoint log sources mapped to the processCreation record type.
Data Sources
Required Tables
False Positives & Tuning
- Network operations center technicians executing netsh wlan commands interactively for wireless infrastructure diagnostics or troubleshooting on corporate laptops
- Endpoint management platforms (SCCM, Intune, PDQ Deploy) invoking netsh wlan as part of automated Wi-Fi profile provisioning or cleanup scripts
- macOS IT administration tooling using the security command-line binary for legitimate certificate enrollment, keychain export, or password management operations
Other platforms for T1016.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate All Saved Wi-Fi Profiles
Expected signal: Sysmon Event ID 1: Process Create with Image=netsh.exe, CommandLine containing 'wlan show profiles'. Security Event ID 4688 (if command line auditing enabled). Parent process will be the shell used to run the command (e.g., cmd.exe, powershell.exe).
- Test 2Extract Wi-Fi Password in Cleartext
Expected signal: Sysmon Event ID 1: Two Process Create events — first for 'wlan show profiles', second with CommandLine containing 'wlan show profile' and 'key=clear'. Security Event ID 4688 for both executions. The second command is the highest-fidelity indicator.
- Test 3Scan Nearby Wi-Fi Networks via netsh
Expected signal: Sysmon Event ID 1: Two Process Create events with Image=netsh.exe, first CommandLine containing 'wlan show networks mode=bssid', second containing 'wlan show interfaces'. Security Event ID 4688 for both. Output shows currently visible wireless access points.
- Test 4Wi-Fi Discovery via PowerShell Invoking netsh
Expected signal: Sysmon Event ID 1: PowerShell process create, plus multiple netsh.exe child process creates with wlan arguments. Sysmon Event ID 11: File creation event for wifi_recon.txt in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 captures the full script. Parent-child relationship (powershell.exe → netsh.exe) is the key indicator.
- Test 5Linux Wi-Fi Credential File Enumeration
Expected signal: Auditd syscall events for open/read of files under /etc/NetworkManager/system-connections/. Syslog entries for sudo usage. Process execution logs showing ls, grep, cat commands with /etc/NetworkManager/system-connections/ path arguments. On systems with auditd rule '-w /etc/NetworkManager/system-connections/ -p rwa -k wifi_cred_access', generates AUDIT_WATCH events.
References (11)
- https://attack.mitre.org/techniques/T1016/002/
- https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/
- https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/
- https://www.malwarebytes.com/blog/news/2020/04/new-agenttesla-variant-steals-wifi-credentials
- https://www.bleepingcomputer.com/news/security/hackers-steal-wifi-passwords-using-upgraded-agent-tesla-malware/
- https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/
- https://www.trendmicro.com/en_us/research/24/i/mustang-panda.html
- https://www.geeksforgeeks.org/wi-fi-password-connected-networks-windowslinux/
- https://mackeeper.com/blog/find-wi-fi-password-on-mac/
- https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016.002/T1016.002.md
Unlock Pro Content
Get the full detection package for T1016.002 including response playbook, investigation guide, and atomic red team tests.