Detect Wi-Fi Networks in Microsoft Sentinel
This detection identifies adversary activity consistent with gaining initial access via wireless network connections, including Wi-Fi network enumeration, suspicious wireless profile creation or modification, connection to new or unauthorized SSIDs, and process execution of wireless management utilities. The detection focuses on command-line wireless management tools (netsh wlan, nmcli, iwconfig, wpa_cli), Windows WLAN AutoConfig operational events, and anomalous wireless interface activity on dual-homed systems that may indicate a Nearest Neighbor-style bridging attack. Associated with APT28 operations documented in the Volexity Nearest Neighbor report, where threat actors compromised geographically proximate organizations to pivot via Wi-Fi into high-value targets.
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1669 Wi-Fi Networks
- Canonical reference
- https://attack.mitre.org/techniques/T1669/
KQL Detection Query
let WifiManagementCommands = dynamic([
"netsh wlan connect",
"netsh wlan add profile",
"netsh wlan export profile",
"netsh wlan delete profile",
"netsh wlan show networks",
"netsh wlan show profiles",
"netsh wlan set profileparameter",
"Connect-WifiNetwork",
"Add-WifiProfile",
"iwconfig",
"nmcli device wifi",
"nmcli con add type wifi",
"wpa_cli connect",
"wpa_cli scan"
]);
let WifiEnumCommands = dynamic([
"netsh wlan show networks",
"netsh wlan show profiles",
"netsh wlan show interfaces",
"nmcli device wifi list",
"iwlist scan",
"airport -s",
"wpa_cli scan_results"
]);
union
(
DeviceProcessEvents
| where TimeGenerated > ago(1h)
| where ProcessCommandLine has_any (WifiManagementCommands)
| extend ActivityType = case(
ProcessCommandLine has "connect", "WiFi Connection Attempt",
ProcessCommandLine has "add profile" or ProcessCommandLine has "con add type wifi", "WiFi Profile Created",
ProcessCommandLine has "delete profile", "WiFi Profile Deleted",
ProcessCommandLine has "export profile", "WiFi Profile Exported",
ProcessCommandLine has "show networks" or ProcessCommandLine has "scan", "WiFi Network Enumeration",
"WiFi Management Activity"
)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ActivityType,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName, FolderPath, ReportId
),
(
SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4688
| where CommandLine has_any (WifiManagementCommands)
| extend ActivityType = case(
CommandLine has "connect", "WiFi Connection Attempt",
CommandLine has "add profile", "WiFi Profile Created",
CommandLine has "show networks", "WiFi Network Enumeration",
"WiFi Management Activity"
)
| project TimeGenerated, Computer, SubjectUserName, CommandLine, ActivityType,
NewProcessName, ParentProcessName
)
| order by TimeGenerated descDetects wireless network management commands executed via process events and Security audit logs. Covers Windows netsh wlan operations for connecting, profiling, and enumerating Wi-Fi networks, as well as Linux wireless tools (nmcli, iwconfig, wpa_cli). Elevated priority for connection and profile creation events over enumeration alone. Particularly relevant for dual-homed endpoints where a wired corporate system suddenly issues wireless connection commands, indicative of a Nearest Neighbor-style bridging attack.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators using netsh wlan for legitimate network troubleshooting or configuration management of corporate laptops
- Corporate endpoint management tools (SCCM, Intune) deploying or rotating Wi-Fi profiles via scripted netsh commands during device provisioning
- Security tools and network assessment software (Nmap, Kismet host agents) performing authorized Wi-Fi surveys on designated scan hosts
- Developers and network engineers running wireless diagnostics on test systems or lab environments
- Automated onboarding scripts that connect new employee devices to corporate SSIDs using pre-staged profiles
Other platforms for T1669
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Wi-Fi Network Enumeration via netsh
Expected signal: DeviceProcessEvents: ProcessCommandLine contains 'netsh wlan show networks' with parent process cmd.exe or PowerShell. SecurityEvent 4688 if process auditing enabled. Sysmon EventID 1 with CommandLine matching netsh wlan.
- Test 2Create and Connect to Wireless Profile on Windows
Expected signal: WLAN AutoConfig EventID 20019 (profile added) and EventID 8001 or 8002 (connect attempt). DeviceProcessEvents for netsh wlan add profile and netsh wlan connect. Temp file creation event for atomic_wifi.xml (Sysmon EventID 11).
- Test 3Linux Wireless Network Scan and Profile Enumeration
Expected signal: Linux auditd syscall audit for execve of nmcli, iwconfig, ip, cat processes with wireless-related arguments. Syslog entries from NetworkManager for scan requests. auditd EXECVE records if auditd is configured with -a always,exit -F arch=b64 -S execve rules.
- Test 4Export Wireless Profile with PSK (Credential Theft Simulation)
Expected signal: DeviceProcessEvents for netsh wlan export profile with key=clear parameter. Sysmon EventID 11 (file create) for XML files written to TEMP directory. Possible DeviceFileEvents for subsequent file read if contents are further processed.
References (5)
- https://attack.mitre.org/techniques/T1669/
- https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wifi-networks-for-covert-access/
- https://www.justice.gov/opa/press-release/file/1098481/download
- https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/wifi-wlan-autoconfig-events
- https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-wlan
Unlock Pro Content
Get the full detection package for T1669 including response playbook, investigation guide, and atomic red team tests.