Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1016.002sub-technique of T1016 System Network Configuration Discovery

Wi-Fi Discovery

Linux · Windows · macOSnothing on this site yetT1016.002 on attack.mitre.org

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Account Discovery, Remote System Discovery, and other discovery or Credential Access activity to support both ongoing and future campaigns. Adversaries may collect various types of information about Wi-Fi networks from hosts.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Behavioral Detection of Wi-Fi Discovery Activity

  • Enumeration of saved Wi-Fi profiles and cleartext password retrieval using `netsh wlan` or API-level access to `wlanAPI.dll`.
  • File access to NetworkManager connection configs and attempts to read PSK credentials from `/etc/NetworkManager/system-connections/*`.
  • Use of the `security` command or Keychain API to extract known Wi-Fi passwords for target SSIDs.

the rest of T1016

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.