System Network Configuration Discovery: Wi-Fi Discovery

ID Name
T1422.001 Internet Connection Discovery
T1422.002 Wi-Fi Discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Discovery or Credential Access activity to support both ongoing and future campaigns.

ID: T1422.002
Sub-technique of:  T1422
Tactic: Discovery
Platforms: Android, iOS
Version: 1.0
Created: 21 February 2024
Last Modified: 21 February 2024

Procedure Examples

ID Name Description

BOULDSPY can collect network information, such as IP address, SIM card info, and Wi-Fi info.[1]

S0425 Corona Updates

Corona Updates can collect device network configuration information, such as Wi-Fi SSID and IMSI.[2]

S1077 Hornbill

Hornbill can collect a device's phone number and IMEI, and can check to see if Wi-Fi is enabled.[3]


INSOMNIA can collect the device’s phone number, ICCID, IMEI, and the currently active network interface (Wi-Fi or cellular).[4]

S0407 Monokle

Monokle checks if the device is connected via Wi-Fi or mobile data.[5]

S0316 Pegasus for Android

Pegasus for Android checks if the device is on Wi-Fi, a cellular network, and is roaming.[6]

S0326 RedDrop

RedDrop collects and exfiltrates information including IMEI, IMSI, MNC, MCC, nearby Wi-Fi networks, and other device and SIM-related info.[7]

S1056 TianySpy

TianySpy can check to see if Wi-Fi is enabled.[8]

S0427 TrickMo

TrickMo can collect device network configuration information such as IMSI, IMEI, and Wi-Fi connection state.[9]


ID Mitigation Description
M1006 Use Recent OS Version

Android 10 introduced changes that prevent normal applications from accessing sensitive device identifiers.[10]


ID Data Source Data Component Detects
DS0041 Application Vetting Permissions Requests

Application vetting services could look for usage of the READ_PRIVILEGED_PHONE_STATE Android permission. This could indicate that non-system apps are attempting to access information that they do not have access to.