Wi-Fi Discovery (T1016.002) is a sub-technique of System Network Configuration Discovery. Adversaries search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. MITRE lists Linux, Windows and macOS.
How attackers use it
MITRE says Wi-Fi information can feed account discovery, remote system discovery and credential access, and support current and future campaigns. On Windows, the netsh wlan show profiles command lists previously joined networks, and adding the key option to the profile command can show a saved password. Nearby networks can be listed through calls to wlanAPI.dll. On Linux, saved networks and passwords may be in files under /etc/NetworkManager/system-connections. On macOS, the security find-generic-password command can reveal a known network's password, and it requires an administrator username and password.
How to detect it
MITRE's analytic by platform:
- Windows: enumeration of saved Wi-Fi profiles and cleartext key retrieval with netsh wlan, or API-level access to wlanAPI.dll.
- Linux: file access to NetworkManager connection configs and attempts to read the PSK from them.
- macOS: use of the security command or Keychain API to extract Wi-Fi passwords for target SSIDs.
Process creation events with command lines catch the netsh and security commands. On Linux, set a file watch on the NetworkManager directory.
How to reduce the risk
MITRE lists no mitigations. Sensible steps: avoid one shared pre-shared key for corporate Wi-Fi, since a key found on one laptop then opens the network. Use per-user or per-device authentication such as certificates, and remove saved networks that are no longer needed.
Why saved networks matter
A laptop remembers every network it has joined. That list reveals where the user goes, and the stored keys may open networks at home or at partner sites. For a corporate network, the stored key is the worry. If the same key is used on many devices, one stolen laptop gives away the key for all.
Prefer certificate-based or per-user authentication for corporate Wi-Fi. Then a saved profile on a stolen host holds no shared secret. For guest networks, rotate keys on a schedule and keep them separate from the internal network.
Quick check
Why is a shared Wi-Fi key risky here?
A saved key read from one compromised laptop works for every device. Per-user or per-device authentication limits what one host reveals.
