| ID | Name |
|---|---|
| T1422.001 | Internet Connection Discovery |
| T1422.002 | Wi-Fi Discovery |
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Discovery or Credential Access activity to support both ongoing and future campaigns.
| ID | Name | Description |
|---|---|---|
| S1079 | BOULDSPY |
BOULDSPY can collect network information, such as IP address, SIM card information, and Wi-Fi information.[1] |
| S0425 | Corona Updates |
Corona Updates can collect device network configuration information, such as Wi-Fi SSID and IMSI.[2] |
| S9005 | DocSwap |
DocSwap has checked for the |
| S1077 | Hornbill |
Hornbill can collect a device's phone number and IMEI, and can check to see if Wi-Fi is enabled.[4] |
| S0463 | INSOMNIA |
INSOMNIA can collect the device’s phone number, ICCID, IMEI, and the currently active network interface (Wi-Fi or cellular).[5] |
| S1185 | LightSpy |
LightSpy uses the WifiList (or |
| S0407 | Monokle |
Monokle checks if the device is connected via Wi-Fi or mobile data.[10] |
| S0316 | Pegasus for Android |
Pegasus for Android checks if the device is on Wi-Fi, a cellular network, and is roaming.[11] |
| S0326 | RedDrop |
RedDrop collects and exfiltrates information including IMEI, IMSI, MNC, MCC, nearby Wi-Fi networks, and other device and SIM-related info.[12] |
| S1056 | TianySpy | |
| S0427 | TrickMo |
TrickMo can collect device network configuration information such as IMSI, IMEI, and Wi-Fi connection state.[14] |
| S9006 | VajraSpy |
| ID | Mitigation | Description |
|---|---|---|
| M1006 | Use Recent OS Version |
Android 10 introduced changes that prevent normal applications from accessing sensitive device identifiers.[16] |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0709 | Detection of Wi-Fi Discovery | AN1833 |
For Android, detect Wi-Fi Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: WifiManager.getScanResults()]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1834 |
For iOS, detect Wi-Fi Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: CNCopyCurrentNetworkInfo() or NEHotspotHelper.register() called by app NOT IN $WiFiAllowList$]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]; Permissions Request via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |