| name | T1016.002_wi-fi-discovery |
| description | Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1016.002","discovery","linux","windows","macos","sub-technique"] |
| technique_id | T1016.002 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["Linux","Windows","macOS"] |
| mitre_url | https://attack.mitre.org/techniques/T1016/002 |
| tech_stack | ["linux","windows","macos"] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["T1016","T1016.001"] |
| prerequisites | ["T1016"] |
| severity_boost | {"T1016":"Chain with T1016 for deeper attack path","T1016.001":"Chain with T1016.001 for deeper attack path"} |
T1016.002 Wi-Fi Discovery
Sub-technique of: T1016
High-Level Description
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Account Discovery, Remote System Discovery, and other discovery or Credential Access activity to support both ongoing and future campaigns.
Adversaries may collect various types of information about Wi-Fi networks from hosts. For example, on Windows names and passwords of all Wi-Fi networks a device has previously connected to may be available through netsh wlan show profiles to enumerate Wi-Fi names and then netsh wlan show profile “Wi-Fi name” key=clear to show a Wi-Fi network’s corresponding password. Additionally, names and other details of locally reachable Wi-Fi networks can be discovered using calls to wlanAPI.dll Native API functions.
On Linux, names and passwords of all Wi-Fi-networks a device has previously connected to may be available in files under /etc/NetworkManager/system-connections/. On macOS, the password of a known Wi-Fi may be identified with security find-generic-password -wa wifiname (requires admin username/password).
Kill Chain Phase
Platforms: Linux, Windows, macOS
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Enumerate Stored Wi-Fi Profiles And Passwords via netsh
Upon successful execution, information about previously connected Wi-Fi networks will be displayed with their corresponding key (if present).
Supported Platforms: windows
netsh wlan show profile * key=clear
