T1669
Wi-Fi Networks
Linux · Network Devices · Windows · macOSnothing on this site yetT1669 on attack.mitre.org
Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks , requiring Valid Accounts , belonging to a target organization. Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Edge appliance or VPN compromise
A vendor advisory for a device you run at the perimeter, unexplained admin sessions on it, or an internal alert whose earliest source is the VPN range.
Web shell on a public-facing server
An unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.
how MITRE says to see it
Detection Strategy for Wi-Fi Networks
- Detects anomalous wireless connections such as unexpected SSID associations, failed or repeated authentication attempts, and connections outside of known geofenced networks. Defenders should monitor wireless connection logs and event codes for network discovery, authentication, and association events.
- Detects unauthorized wireless associations by monitoring wpa_supplicant logs, NetworkManager events, and system calls related to interface state changes. Anomalies include repeated association failures, new SSIDs outside baselined values, and rogue AP connections.
- Detects unauthorized Wi-Fi associations and SSID scanning activity using unified logs and airport command telemetry. Anomalies include rapid SSID switching, connections to unapproved SSIDs, or repeated authentication failures.
- Detects rogue or suspicious wireless access attempts by monitoring firewall, WIDS/WIPS, and controller logs. Focus is on firewall rule changes, rogue AP detection, and anomalous MAC addresses connecting to access points.
what reduces it
- M1030 Network Segmentation. Network segmentation can be used to isolate infrastructure components that do not require broad network access. Separate networking environments for Wi-Fi and Ethernet-wired networks, particularly where Ethernet-based networks allow for access to sensitive resources.
- M1032 Multi-factor Authentication. Harden access requirements for Wi-Fi networks through using two or more pieces of evidence to authenticate, such as a username and password in addition to a token from a physical smart card or token generator.
- M1041 Encrypt Sensitive Information. Ensure that all wired and/or wireless traffic is encrypted appropriately. Use best practices for authentication protocols, such as Kerberos, and ensure that web traffic that may contain credentials is protected by SSL/TLS.