Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

ATT&CK index / stage 3 of 15

Initial Access

How they got in. The single most valuable thing to establish, because everything downstream reopens if you miss it.

Techniques
2211 parent
With mitigations
2288 listed
Detection strategies
22from ATT&CK analytics

If this is live right now

Stop reading the matrix and work the playbook. The reference below is for afterwards, when you are deciding what to change.

  • Edge appliance or VPN compromiseA vendor advisory for a device you run at the perimeter, unexplained admin sessions on it, or an internal alert whose earliest source is the VPN range.
  • Web shell on a public-facing serverAn unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.

The techniques

open one for mitigations and detection
T1078Valid Accounts33 on this site6 mitigations4 sub-techniquesAdversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.

Platforms: Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

What reduces it

  • M1013 Application Developer Guidance. Ensure that applications do not store sensitive data or credentials insecurely. (e.g. plaintext credentials in code, published credentials in repositories, or credentials in public cloud storage).
  • M1017 User Training. Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications.
  • M1027 Password Policies. Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. When possible, applications that use SSH keys should be updated periodically and properly secured.
  • M1018 User Account Management. Regularly audit user accounts for activity and deactivate or remove any that are no longer needed.
  • M1026 Privileged Account Management. Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. These audits should also include if default accounts have been enabled, or if new local accounts are created that have not been authorized.
  • M1032 Multi-factor Authentication. Implement multi-factor authentication (MFA) across all account types, including default, local, domain, and cloud accounts, to prevent unauthorized access, even if credentials are compromised. MFA provides a critical layer of security by requiring multiple forms of verification beyond just a password.

How to see it

  • Detection of Valid Account Abuse Across Platforms

    • Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.
    • Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.
    • Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.
    • Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

Sub-techniques

  • T1078.001 Default Accounts · 1 on this site. Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems.
  • T1078.002 Domain Accounts · 4 on this site. Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
  • T1078.003 Local Accounts. Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping.
  • T1078.004 Cloud Accounts · 18 on this site. Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Everything on this site for T1078 →T1078 on attack.mitre.org

T1091Replication Through Removable Media3 mitigationsAdversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate...

Platforms: Windows

What reduces it

  • M1034 Limit Hardware Installation. Limit the use of USB devices and removable media within a network.
  • M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to block unsigned/untrusted executable files (such as.exe,.dll, or.scr) from running from USB removable drives.
  • M1042 Disable or Remove Feature or Program. Disable Autorun if it is unnecessary. Disallow or restrict removable media at an organizational policy level if it is not required for business operations.

How to see it

  • Removable Media Execution Chain Detection via File and Process Activity

    • Execution of files originating from removable media after drive mount, with correlation to file write activity, autorun usage, or lateral spread via staged tools.

The T1091 page →T1091 on attack.mitre.org

T1133External Remote Services2 on this site5 mitigationsAdversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Platforms: Containers, Linux, macOS, Windows

What reduces it

  • M1035 Limit Access to Resource Over Network. Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.
  • M1021 Restrict Web-Based Content. Restrict all traffic to and from public Tor nodes.
  • M1030 Network Segmentation. Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
  • M1032 Multi-factor Authentication. Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of Multi-Factor Authentication Interception techniques for some two-factor authentication implementations.
  • M1042 Disable or Remove Feature or Program. Disable or block remotely available services that may be unnecessary.

How to see it

  • Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers

    • Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.
    • Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).
    • Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.
    • Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

Everything on this site for T1133 →T1133 on attack.mitre.org

T1189Drive-by Compromise1 on this site5 mitigationsAdversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served...

Platforms: Identity Provider, Linux, macOS, Windows

What reduces it

  • M1021 Restrict Web-Based Content. Adblockers can help prevent malicious code served through ads from executing in the first place. Script blocking extensions can also help to prevent the execution of JavaScript. Consider disabling browser push notifications from certain applications and browsers.
  • M1017 User Training. Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.
  • M1048 Application Isolation and Sandboxing. Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. The risks of additional exploits and weaknesses in implementation may still exist for these types of systems.
  • M1050 Exploit Protection. Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring.
  • M1051 Update Software. Ensuring that all browsers and plugins are kept updated can help prevent the exploit phase of this technique. Use modern browsers with security features turned on.

How to see it

  • Drive-by Compromise , Behavior-based, Multi-platform Detection Strategy (T1189)

    • Correlated evidence of anomalous browser/network behavior (suspicious external resource fetches and script injection patterns) followed by atypical child processes, ephemeral execution contexts, memory modification or process injection, and unexpected file drops.
    • Correlated evidence of browser or webview fetches to uncommon domains or mutated JS resources (proxy/NGFW logs + Zeek/HTTP logs) followed by unexpected interpreters or script engines executing (python, ruby, sh) spawned from browser processes or user sessions, rapid on-disk staging in /tmp, and outbound connections...
    • Correlated evidence where Safari/Chrome/WebKit-based processes issue network requests for uncommon or obfuscated JS resources followed by spawning of script interpreters, launchd or ad-hoc binaries, unusual child processes, or dynamic library loads into browser processes.
    • Post-compromise identity & session anomalies that follow a drive-by compromise: token reuse from new/unfamiliar IPs, anomalous sign-in patterns for previously inactive users, unexpected consent/grant events, or provisioning changes.

Everything on this site for T1189 →T1189 on attack.mitre.org

T1190Exploit Public-Facing Application9 on this site6 mitigationsAdversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with...

Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows

What reduces it

  • M1016 Vulnerability Scanning. Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.
  • M1035 Limit Access to Resource Over Network. Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.
  • M1037 Filter Network Traffic. Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.
  • M1030 Network Segmentation. Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
  • M1026 Privileged Account Management. Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.
  • M1048 Application Isolation and Sandboxing. Application isolation will limit what other processes and system features the exploited target can access.

How to see it

  • Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)

    • Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules →...
    • Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.
    • Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.
    • Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

Everything on this site for T1190 →T1190 on attack.mitre.org

T1195Supply Chain Compromise5 on this site6 mitigations3 sub-techniquesAdversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of...

Platforms: Linux, Windows, macOS, SaaS

What reduces it

  • M1016 Vulnerability Scanning. Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.
  • M1033 Limit Software Installation. Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.
  • M1013 Application Developer Guidance. Application developers should be cautious when selecting third-party libraries to integrate into their application. Additionally, where possible, developers should lock software dependencies to specific versions rather than pulling the latest version on build.
  • M1046 Boot Integrity. Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.
  • M1018 User Account Management. Implement robust user account management practices to limit permissions associated with software execution. Ensure that software runs with the lowest necessary privileges, avoiding the use of root or administrator accounts when possible.
  • M1051 Update Software. A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.

How to see it

  • Behavioral detection for Supply Chain Compromise (package/update tamper → install → first-run)

    • 1) New or updated software is delivered/installed from atypical sources or with signature/hash mismatches; 2) installer/updater writes binaries to unexpected paths or replaces existing signed files; 3) first run causes unsigned/abnormally signed modules to load or child processes to execute, optionally followed by...
    • 1) Package manager or curl/wget installs/upgrades from non-approved repos or unsigned packages; 2) new ELF written into PATH directories or replacement of existing binaries/libraries; 3) first run leads to unexpected child processes or outbound connections.
    • 1) pkg/notarization installs from atypical sources or with Gatekeeper/AMFI warnings; 2) new Mach-O written into /Applications or ~/Library paths or substitution of signed components; 3) first run from installer spawns unsigned children or exfil.

Sub-techniques

  • T1195.001 Compromise Software Dependencies and Development Tools · 2 on this site. Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.
  • T1195.002 Compromise Software Supply Chain · 3 on this site. Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
  • T1195.003 Compromise Hardware Supply Chain. Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system.

Everything on this site for T1195 →T1195 on attack.mitre.org

T1199Trusted Relationship1 on this site3 mitigationsAdversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments.

Platforms: IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows

What reduces it

  • M1030 Network Segmentation. Network segmentation can be used to isolate infrastructure components that do not require broad network access.
  • M1018 User Account Management. Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary. In Office 365 environments, partner relationships and roles can be viewed under the “Partner Relationships” page.
  • M1032 Multi-factor Authentication. Require MFA for all delegated administrator accounts.

How to see it

  • Detect abuse of Trusted Relationships (third-party and delegated admin access)

    • Behavioral chain: (1) a login from a third-party account or untrusted source network establishes an interactive/remote session; (2) the session acquires elevated privileges or accesses sensitive resources atypical for that account; (3) subsequent lateral movement or data access occurs from the same session/device.
    • Behavioral chain: (1) sshd or federated SSO logins from third-party networks or identities; (2) rapid sudo/su privilege elevation; (3) access to sensitive paths or east-west SSH. Correlate auth logs, process execution, and network flows.
    • Behavioral chain: (1) third-party interactive login or mobileconfig-based device enrollment; (2) privilege use or admin group change; (3) lateral movement mounts/ssh. Correlate unified logs and network telemetry.
    • Behavioral chain: (1) delegated admin or external identity establishes session (e.g., partner/reseller DAP, B2B guest, SAML/OAuth trust); (2) role elevation or app consent/permission grant; (3) downstream privileged actions in the tenant. Correlate IdP sign-in, admin/role assignment, and consent/admin-on-behalf events.

Everything on this site for T1199 →T1199 on attack.mitre.org

T1200Hardware Additions2 mitigationsAdversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.

Platforms: Windows, Linux, macOS

What reduces it

  • M1035 Limit Access to Resource Over Network. Establish network access control policies, such as using device certificates and the 802.1x standard. Restrict use of DHCP to registered devices to prevent unregistered devices from communicating with trusted systems.
  • M1034 Limit Hardware Installation. Block unknown devices and accessories by endpoint security configuration and monitoring agent.

How to see it

  • Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network)

    • Chain: (1) a new external device is recognized by Windows (USB/Thunderbolt/PCIe) or a new block device appears; (2) within a short window, the same user/session spawns processes or the OS mounts a new volume; (3) optional follow-on activity such as HID keystroke injection, DMA driver load, or new network interface MAC...
    • Chain: (1) udev / kernel logs show hot-plug (USB/Thunderbolt/PCIe); (2) block device created by udisks/diskarbitration; (3) optional: new network interface or DHCP lease observed. Correlate /var/log/messages|syslog, auditd SYSCALL open/creat on /dev, and DHCP/Zeek.
    • Chain: (1) unified logs report IOUSBHost/IOThunderbolt device arrival; (2) diskarbitrationd attaches a new volume; (3) optional: config profile manipulation or new network interface MAC obtains a lease. Correlate unifiedlogs (subsystems: IOUSBHost, IOKit, diskarbitrationd), FSEvents, and DHCP/Zeek.

The T1200 page →T1200 on attack.mitre.org

T1566Phishing8 on this site6 mitigations4 sub-techniquesAdversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Platforms: Identity Provider, Linux, macOS, Office Suite, SaaS, Windows

What reduces it

  • M1031 Network Intrusion Prevention. Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.
  • M1021 Restrict Web-Based Content. Determine if certain websites or attachment types (ex:.scr,.exe,.pif,.cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.
  • M1017 User Training. Users can be trained to identify social engineering techniques and phishing emails.
  • M1049 Antivirus/Antimalware. Anti-virus can automatically quarantine suspicious files.
  • M1054 Software Configuration. Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.
  • M1047 Audit. Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.

How to see it

  • Detection Strategy for Phishing across platforms.

    • Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.
    • Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.
    • Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.
    • Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.

Sub-techniques

  • T1566.001 Spearphishing Attachment · 2 on this site. Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.
  • T1566.002 Spearphishing Link · 7 on this site. Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
  • T1566.003 Spearphishing via Service. Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
  • T1566.004 Spearphishing Voice. Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications.

Everything on this site for T1566 →T1566 on attack.mitre.org

T1659Content Injection2 mitigationsAdversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content.

Platforms: Linux, macOS, Windows

What reduces it

  • M1021 Restrict Web-Based Content. Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns.
  • M1041 Encrypt Sensitive Information. Where possible, ensure that online traffic is appropriately encrypted through services such as trusted VPNs.

How to see it

  • Detection Strategy for Content Injection

    • Detect suspicious file creations and process executions triggered by browser activity (e.g., injected payloads written to %AppData% or Temp directories, then executed). Correlate network anomalies with subsequent local process creation or script execution.
    • Detect curl/wget commands saving executable/script payloads to /tmp or /var/tmp followed by execution. Monitor packet captures or IDS/IPS alerts for injected responses or mismatched content types.
    • Monitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written.

The T1659 page →T1659 on attack.mitre.org

T1669Wi-Fi Networks3 mitigationsAdversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks , requiring Valid Accounts , belonging to a target organization. Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection.

Platforms: Linux, Network Devices, Windows, macOS

What reduces it

  • M1030 Network Segmentation. Network segmentation can be used to isolate infrastructure components that do not require broad network access. Separate networking environments for Wi-Fi and Ethernet-wired networks, particularly where Ethernet-based networks allow for access to sensitive resources.
  • M1032 Multi-factor Authentication. Harden access requirements for Wi-Fi networks through using two or more pieces of evidence to authenticate, such as a username and password in addition to a token from a physical smart card or token generator.
  • M1041 Encrypt Sensitive Information. Ensure that all wired and/or wireless traffic is encrypted appropriately. Use best practices for authentication protocols, such as Kerberos, and ensure that web traffic that may contain credentials is protected by SSL/TLS.

How to see it

  • Detection Strategy for Wi-Fi Networks

    • Detects anomalous wireless connections such as unexpected SSID associations, failed or repeated authentication attempts, and connections outside of known geofenced networks. Defenders should monitor wireless connection logs and event codes for network discovery, authentication, and association events.
    • Detects unauthorized wireless associations by monitoring wpa_supplicant logs, NetworkManager events, and system calls related to interface state changes. Anomalies include repeated association failures, new SSIDs outside baselined values, and rogue AP connections.
    • Detects unauthorized Wi-Fi associations and SSID scanning activity using unified logs and airport command telemetry. Anomalies include rapid SSID switching, connections to unapproved SSIDs, or repeated authentication failures.
    • Detects rogue or suspicious wireless access attempts by monitoring firewall, WIDS/WIPS, and controller logs. Focus is on firewall rule changes, rogue AP detection, and anomalous MAC addresses connecting to access points.

The T1669 page →T1669 on attack.mitre.org

Technique descriptions, mitigations and detection analytics on this page are reproduced from MITRE ATT&CK, ATT&CK version 19.2, retrieved 2026-09-12. ATT&CK is a registered trademark of The MITRE Corporation and is used here under its terms of use. The playbooks, and the sentence describing what this stage means for a responder, are ours.