MITRE ATT&CK - Técnica

T1669: Wi-Fi Networks

Wi-Fi Networks (T1669) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1669 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Wi-Fi Networks deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Initial Access. As plataformas mapeadas pela MITRE incluem Linux, Network Devices, Windows e macOS. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Initial Access
Plataformas MITRE Linux, Network Devices, Windows, macOS

Descrição oficial original do MITRE ATT&CK

Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks — requiring Valid Accounts — belonging to a target organization. Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection. Adversaries may establish a wireless connection through various methods, such as by physically positioning themselves near a Wi-Fi network to conduct close access operations. To bypass the need for physical proximity, adversaries may attempt to remotely compromise nearby third-party systems that have both wired and wireless network connections available (i.e., dual-homed systems). These third-party compromised devices can then serve as a bridge to connect to a target’s Wi-Fi network. Once an initial wireless connection is achieved, adversaries may leverage this access for follow-on activities in the victim network or further targeting of specific devices on the network. Adversaries may perform Network Sniffing or Adversary-in-the-Middle activities for Credential Access or Discovery.

Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Wi-Fi Networks automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma