1200KM / detection
T1016.002 Wi-Fi Discovery — Detection Rules
Detection workspace for T1016.002 Wi-Fi Discovery: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0464 Behavioral Detection of Wi-Fi Discovery Activity
AN1280 Analytic 1280
Enumeration of saved Wi-Fi profiles and cleartext password retrieval using `netsh wlan` or API-level access to `wlanAPI.dll`.
AN1281 Analytic 1281
File access to NetworkManager connection configs and attempts to read PSK credentials from `/etc/NetworkManager/system-connections/*`.
AN1282 Analytic 1282
Use of the `security` command or Keychain API to extract known Wi-Fi passwords for target SSIDs.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1016.002 simulation workspace
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.