Wireless Connection History

Overview

Evidence: Wireless Connection History Description: Enumerate Wireless Connection History Category: Network Platform: windows Short Name: wrlsshst Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Windows network profiles store SSIDs and connection metadata (first/last connected, category, managed). This data is essential for tracking network access.

Data Collected

This collector gathers structured data about wireless connection history.

Collection Method

This collector reads HKLM...\NetworkList\Profiles for each profile, extracting timestamps and attributes into wireless_history.

Forensic Value

This evidence is crucial for forensic investigations to link hosts to networks over time and identify suspicious connections.