This note documents detection patterns related to Wi-Fi Activity / Wireless Network Forensics within Windows environments.

Direct Indicators

Indirect Indicators

Common Tools

Relevant Artifacts

• Event Log:

  • Applications and Services Logs → Microsoft → Windows → WLAN-AutoConfig → Operational

• Registry:

  • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
  • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed
  • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged
  • HKLM\SOFTWARE\Microsoft\WcmSvc\Profiles

• Wireless Profiles:

  • C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{GUID}\*.xml

• XML profile files contain:

  • SSID
  • Authentication type
  • Encryption type
  • Connection mode

• Registry Explorer keys:

  • NetworkList
  • NetworkCards

• Additional:

  • SRUM network usage
  • DHCP lease evidence HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID}
  • ARP cache correlation

Registry Interpretation

MITRE ATT&CK References

• T1016 System Network Configuration Discovery
• T1021 Remote Services
• T1049 System Network Connections Discovery

Decision Tree

1. Was wireless used?

   • WLAN events present?
   • Profile exists?

2. Which SSID?

   • Known corporate?
   • Public?
   • Hotspot?

3. When first seen?

   • Registry timestamp
   • Event timestamp

4. Successful connection?

   • 11005 / 8001

5. Follow-up activity?

   • DHCP
   • DNS
   • Browser
   • Lateral movement

6. Scope:

   • Single AP
   • Multiple APs
   • Movement pattern

Example Detection Templates

KQL

Event
| where EventLog == "Microsoft-Windows-WLAN-AutoConfig/Operational"
| where EventID in (8001,8003,11004,11005,11006)
| project TimeGenerated, Computer, EventID, RenderedDescription

EQL

any where event.code == "8001"

sequence by host.name with maxspan=10m
  [ any where event.code == "11004" ]
  [ any where event.code == "11005" ]

Sigma

title: Wireless Network Association Detected
id: 7d3f2b22-wifi-association
status: experimental
description: Detects wireless network association events
author: Vergil
date: 2026-03-10
logsource:
  product: windows
  service: wlan-autoconfig
detection:
  selection:
    EventID:
      - 8001
      - 11005
  condition: selection
fields:
  - EventID
  - Computer
falsepositives:
  - Normal roaming
level: medium
tags:
  - attack.discovery

Mitigation & Hardening

Investigator Notes

• NetworkList timestamps often survive longer than logs.

• XML wireless profiles frequently outlive event retention.

• Public hotspot evidence often explains lateral movement context.

• Hidden SSIDs deserve immediate scrutiny.

• Wireless artifacts become extremely valuable in laptop investigations.