Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

T1422.002 Wi-Fi Discovery · cyberstrikeus | DecimalAI

cyberstrikeus/T1422.002_wi-fi-discovery

SkillScore87Maintained

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackmobilet1422.002

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1422-002-wi-fi-discovery/SKILL.md

decimalai skills pull cyberstrikeus-t1422-002-wi-fi-discovery --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1422-002-wi-fi-discovery/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1422-002-wi-fi-discovery/SKILL.md

Raw file: /s/cyberstrikeus-t1422-002-wi-fi-discovery/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1422-002-wi-fi-discovery.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 28d ago

Yes — +43% lift-37% tokens0% turns87% of whole cases pass with skill (20/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-04	✗→✓	▲ Improved	-91%	0%
case-05	✗→✓	▲ Improved	-85%	0%
case-06	✗→✓	▲ Improved	-68%	0%
case-09	✗→✓	▲ Improved	-75%	0%
case-10	✗→✓	▲ Improved	-73%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack_mobile/TA0032_discovery/T1422.002_wi-fi-discovery/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1422.002 Wi-Fi Discovery

> Sub-technique of: T1422

High-Level Description

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of Discovery or Credential Access activity to support both ongoing and future campaigns.

Kill Chain Phase

Discovery (TA0032)

Platforms: Android, iOS

What to Check

] Identify if Wi-Fi Discovery technique is applicable to target mobile environment
] Check Android devices for indicators of Wi-Fi Discovery
] Check iOS devices for indicators of Wi-Fi Discovery
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Identify Attack Surface

Determine if the target mobile environment is susceptible to Wi-Fi Discovery by examining the target platforms (Android, iOS).

Assess Existing Defenses

Review whether mitigations for T1422.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Remediation Guide

M1006 Use Recent OS Version

Android 10 introduced changes that prevent normal applications from accessing sensitive device identifiers.

Detection

Detection of Wi-Fi Discovery

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------ | -------- | --------- | | Wi-Fi Discovery technique applicable | High | Discovery |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-200 | Exposure of Sensitive Information |

References

MITRE ATT&CK Mobile - T1422.002

Illustrative Want to see what cyberstrikeus/T1422.002_wi-fi-discovery would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/31/2026, 19:29 UTC · 23 cases

Lift

+43%

87% vs 43%

Agent turns

0%

1.0 vs 1.0

Tokens

-37%

1,897.39 vs 3,029.61

fail → pass · 10pass → pass · 10fail → fail · 3

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We are performing a mobile security assessment on our corporate Android and iOS smartphones to determine if malicious apps could gather Wi-Fi network names and saved credentials. Please run an assessment covering attack surface applicability, existing OS-level mitigations, detection coverage, and present a risk finding report detailing severity, impact, CWE mapping, and remediation recommendations.	fail→fail	31,020	37,954	+22%	1	1	0%	4,128	5,596	+36%	0	0	—
case-02 Could you audit our mobile endpoint environment against the MITRE ATT&CK Mobile sub-technique for Wi-Fi discovery? I need a breakdown that checks both Android and iOS platforms, verifies if built-in operating system safeguards are active or bypassed, assesses our current detection posture, and formats the findings into a risk assessment table with mitigation steps.	fail→fail	38,002	36,352	-4%	1	1	0%	5,075	5,722	+13%	0	0	—
case-03 I need a security evaluation report on whether unauthorized applications on our mobile devices can expose Wi-Fi credentials or access sensitive wireless identifiers. Please evaluate the attack surface across supported mobile platforms, test for defensive mitigations, identify detection gaps, and produce a structured summary including risk severity and CWE classification.	fail→fail	38,268	34,312	-10%	1	1	0%	5,497	5,441	-1%	0	0	—
case-04 When reviewing mobile OS security controls against wireless network scanning by untrusted applications, an engineer argued that Android 8 (Oreo) background location limits were the primary OS update blocking identifier access. Which specific Android operating system release introduced restriction changes preventing normal applications from reaching sensitive device identifiers, and what mitigation ID corresponds to this?	fail→pass	54,401	19,456	-64%	1	1	0%	7,472	679	-91%	0	0	—
case-05 During a mobile security framework taxonomy review, a junior auditor classified mobile wireless scanning directly under T1016 (System Network Configuration Discovery). What is the official parent technique ID for the mobile Wi-Fi discovery sub-technique?	fail→pass	29,999	7,924	-74%	1	1	0%	4,970	769	-85%	0	0	—
case-06 We are building an automated triage dashboard for mobile endpoint security events. A analyst suggested mapping mobile wireless scanning alerts to the Initial Access tactic (TA0001). Which specific tactic phase and tactic ID (TA code) does this mobile technique actually map to?	fail→pass	22,432	8,865	-60%	1	1	0%	3,223	1,046	-68%	0	0	—
case-07 Our security operations center handles threats across Windows 11, macOS, Android, and iOS. A vendor claim suggests T1422.002 applies equally to desktop OS environments. Which specific operating system platforms are documented as applicable targets for this mobile sub-technique?	pass→pass	25,798	50,270	+95%	1	1	0%	1,811	1,186	-35%	0	0	—
case-08 When submitting our mobile security assessment for regulatory compliance, a reviewer recommended listing CWE-312 (Cleartext Storage of Sensitive Information) for wireless SSID scanning risks. What exact CWE title is formally mapped to CWE-200 for this mobile sub-technique?	pass→pass	31,469	19,518	-38%	1	1	0%	4,087	968	-76%	0	0	—
case-09 Our compliance lead assumes that MITRE ATT&CK Mobile documents 5 distinct mitigation strategies for mobile wireless scanning threats. How many known mitigations are explicitly documented for this technique?	fail→pass	28,967	2,373	-92%	1	1	0%	3,450	862	-75%	0	0	—
case-19 A security analyst needs the official web link to the MITRE ATT&CK Mobile page for T1422.002 to attach to an audit report. Provide the exact reference URL.	pass→pass	10,715	3,746	-65%	1	1	0%	811	684	-16%	0	0	—
case-10 An auditor's draft report states that there are 3 separate detection strategies outlined in the framework technical checklist for mobile Wi-Fi scanning. How many detection strategies are actually specified?	fail→pass	18,551	8,279	-55%	1	1	0%	2,981	810	-73%	0	0	—
case-11 A junior analyst flagged an active finding where mobile applications can collect nearby Wi-Fi network names without authorization. They proposed rating this finding as 'Medium' severity because no root access was achieved. What standard severity level must be assigned to this finding in the risk assessment table?	pass→pass	32,856	7,783	-76%	1	1	0%	2,177	859	-61%	0	0	—
case-12 In our vulnerability tracking matrix, an auditor categorized the impact of unauthorized mobile Wi-Fi discovery as 'Credential Access' because saved network passwords might eventually be compromised. What specific impact category is formally assigned in the risk assessment model?	fail→pass	11,543	3,656	-68%	1	1	0%	1,888	919	-51%	0	0	—
case-13 What is the exact finding text phrase that must be recorded under the Finding column of the risk assessment table when mobile wireless network discovery is determined to be applicable?	fail→pass	22,129	6,814	-69%	1	1	0%	2,784	690	-75%	0	0	—
case-14 An audit checklist template suggests checking Android devices for general root access indicators during wireless threat reviews. What specific indicator check is prescribed for Android devices in the assessment checklist?	fail→pass	15,438	6,997	-55%	1	1	0%	1,457	1,427	-2%	0	0	—
case-15 An iOS audit checklist draft recommends verifying jailbreak status as the primary check for wireless scanning risk. What specific check does the technical methodology require for iOS devices?	pass→pass	18,789	13,401	-29%	1	1	0%	1,826	2,173	+19%	0	0	—
case-16 When evaluating existing defenses against mobile wireless reconnaissance, an auditor recommends assuming OS controls are fully effective unless a kernel exploit is present. What specific defense verification step is required by the methodology?	pass→pass	18,075	9,879	-45%	1	1	0%	2,768	1,110	-60%	0	0	—
case-17 Before conducting deep packet inspection, what initial step must an analyst perform under the assessment methodology to determine if a mobile environment is vulnerable to Wi-Fi discovery?	fail→pass	13,464	8,764	-35%	1	1	0%	1,092	1,109	+2%	0	0	—
case-18 During a mobile security defense review, an engineer argues that even if OS mitigations are completely unconfigured, the technique remains non-exploitable without elevated privileges. Under what defensive state is this technique considered exploitable according to the assessment guide?	pass→pass	22,240	10,863	-51%	1	1	0%	2,455	1,236	-50%	0	0	—
case-20 An analyst notes that adversaries search for Wi-Fi network names and passwords on compromised mobile systems purely for initial execution. What two specific activity types support ongoing or future adversary campaigns according to the high-level description?	fail→pass	16,741	20,890	+25%	1	1	0%	1,881	723	-62%	0	0	—
case-21 We are auditing mobile endpoints for MITRE ATT&CK Mobile sub-technique T1430 Location Discovery on Android and iOS devices. What is the mitigation, risk severity, and CWE mapping for mobile location tracking discovery?	pass→pass	23,348	18,133	-22%	1	1	0%	2,591	2,641	+2%	0	0	—
case-22 Our security team is assessing mobile devices for Bluetooth Discovery (MITRE ATT&CK Mobile T1421) where unauthorized apps scan nearby Bluetooth LE beacons. What is the sub-technique ID and primary mitigation strategy for Bluetooth discovery?	pass→pass	15,467	18,886	+22%	1	1	0%	1,642	2,392	+46%	0	0	—
case-23 We are conducting an assessment of mobile application traffic probing remote internal ports and services (MITRE ATT&CK Mobile T1423 Network Service Discovery). Provide the evaluation methodology for local port scanning from mobile devices.	pass→pass	31,042	33,861	+9%	1	1	0%	3,615	4,598	+27%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +43 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 43.5%
Pass rate with the skill: 87%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/31/2026, 19:29 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-04

Prompt

When reviewing mobile OS security controls against wireless network scanning by untrusted applications, an engineer argued that Android 8 (Oreo) background location limits were the primary OS update blocking identifier access. Which specific Android operating system release introduced restriction changes preventing normal applications from reaching sensitive device identifiers, and what mitigation ID corresponds to this?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run87

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-25% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 27 days ago

Other measured skills in the registry, with their headline benchmark lift.