Techniques › T1669
T1669 Wi-Fi Networks
initial access — Linux, Network Devices, Windows, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1669
0
KEV CVEs mapped here
<p>Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks — requiring Valid Accounts — belonging to a target organization. Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection.</p><p>Adversaries may establish a wireless connection through various methods, such as by physically positioning themselves near a Wi-Fi network to conduct close access operations. To bypass the need for physical proximity, adversaries may attempt to remotely compromise nearby third-party systems that have both wired and wireless network connections available (i.e., dual-homed systems). These third-party compromised devices can then serve as a bridge to connect to a target’s Wi-Fi network.</p><p>Once an initial wireless connection is achieved, adversaries may leverage this access for follow-on activities in the victim network or further targeting of specific devices on the network. Adversaries may perform Network Sniffing or Adversary-in-the-Middle activities for Credential Access or Discovery.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0536 Detection Strategy for Wi-Fi Networks v1.0
AN1476 WindowsDetects anomalous wireless connections such as unexpected SSID associations, failed or repeated authentication attempts, and connections outside of known geofenced networks. Defenders should monitor wireless connection logs and event codes for network discovery, authentication, and association events.WinEventLog:Microsoft-Windows-WLAN-AutoConfig
EventCode=8001, 8002, 8003→ DC0082 Network Connection CreationTunable:KnownSSIDListGeoLocationContextAN1477 LinuxDetects unauthorized wireless associations by monitoring wpa_supplicant logs, NetworkManager events, and system calls related to interface state changes. Anomalies include repeated association failures, new SSIDs outside baselined values, and rogue AP connections.linux:syslogNew Wi-Fi connection established or repeated association failures→ DC0082 Network Connection Creationauditd:SYSCALLioctl: Changes to wireless network interfaces (up, down, reassociate)→ DC0078 Network Traffic FlowTunable:AllowedSSIDRegexRetryThresholdAN1478 macOSDetects unauthorized Wi-Fi associations and SSID scanning activity using unified logs and airport command telemetry. Anomalies include rapid SSID switching, connections to unapproved SSIDs, or repeated authentication failures.macos:unifiedlogAssociation and authentication events including failures and new SSIDs→ DC0082 Network Connection Creationmacos:osqueryquery: Historical list of associated SSIDs compared against baseline→ DC0078 Network Traffic FlowTunable:BaselineSSIDHistoryAN1479 Network DevicesDetects rogue or suspicious wireless access attempts by monitoring firewall, WIDS/WIPS, and controller logs. Focus is on firewall rule changes, rogue AP detection, and anomalous MAC addresses connecting to access points.NSM:Firewallrule_modification: New or modified firewall rules related to wireless interfaces→ DC0051 Firewall Rule ModificationWIDS:AssociationLogsUnauthorized AP or anomalous MAC address connection attempts→ DC0085 Network Traffic ContentTunable:AuthorizedAPList
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1669
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.