TA0007 · DISCOVERY
Wi-Fi Discovery
T1016.002Sub-technique of System Network Configuration DiscoveryLinux · Windows · macOSattack.mitre.org
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
Detect it with
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
Why it matters on shift
Wi-Fi Discovery is one of the concrete ways adversaries achieve discovery. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After discovery, the next tactic is usually Lateral Movement. Search your telemetry for the transition before closing the ticket.
Kill-chain context