<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-rogue-access-points
description: >-
  Detect unauthorized access points on enterprise networks using Kismet, wireless scanning, BSSID baselining, and 802.11 frame analysis.
domain: cybersecurity
subdomain: wireless-security
tags:
  - rogue-ap
  - wids
  - kismet
  - wireless-defense
  - ap-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1200", "T1584.007"]
  nist-csf: ["DE.CM-1", "PR.AC-5", "PR.PT-4"]
  uuid: f9bbe9fe-e5af-4173-8da1-62b948b6666d
---

# Detecting Rogue Access Points

## Overview

Rogue access points are unauthorized wireless APs connected to an enterprise network,
enabling attackers to bypass network access controls. Detection uses passive RF monitoring
with Kismet, BSSID baseline comparison, WIDS alerting, wired-side MAC correlation, and
periodic sweep scanning. Effective rogue AP detection is a critical wireless security control.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Kismet wireless IDS/scanner | Required |
| Monitor-mode capable wireless adapter | Required |
| BSSID/SSID baseline inventory of authorized APs | Required |
| Network management system with AP inventory | Required |
| SNMP or API access to managed switches for MAC correlation | Required |

## Key Concepts

### Rogue AP Classification

```
Rogue AP Types:
├── Employee-installed AP (policy violation)
├── Attacker-planted AP (physical intrusion - T1200)
├── Misconfigured AP (wrong VLAN, open auth)
├── Neighbor AP (not rogue, but interference)
└── Software AP (hostapd on compromised host)
```

### Kismet Scanning

```bash
# Start Kismet with monitor-mode interface
kismet -c wlan0mon

# Kismet REST API — list all detected APs
curl -s http://localhost:2501/devices/views/phydot11_accesspoints/devices.json \
  -u admin:changeme | python3 -m json.tool

# Export detected devices
curl -s http://localhost:2501/devices/all_devices.ekjson \
  -u admin:changeme > all_devices.json
```

### BSSID Baseline Comparison

```bash
# Build authorized AP baseline
cat > authorized_aps.json << EOF
[
  {"bssid": "AA:BB:CC:DD:EE:01", "ssid": "CorpWiFi", "channel": 1},
  {"bssid": "AA:BB:CC:DD:EE:02", "ssid": "CorpWiFi", "channel": 6},
  {"bssid": "AA:BB:CC:DD:EE:03", "ssid": "GuestNet", "channel": 11}
]
EOF

# Scan and compare (airodump-ng CSV output)
sudo airodump-ng wlan0mon -w rogue_scan --output-format csv
# Parse CSV and diff against baseline
```

### Wired-Side Correlation

```bash
# Find rogue AP on wired network via MAC table
# Check switch MAC address tables for wireless AP OUIs
# Common wireless AP OUI prefixes: Ubiquiti (24:A4:3C), Cisco (00:1A:A1)
# If an unknown AP MAC appears on a switch port — rogue confirmed
```

## Workflow

### Step 1: Build Baseline

Document all authorized APs with BSSID, SSID, channel, and physical location.

### Step 2: Deploy Continuous Monitoring

```bash
kismet -c wlan0mon --override kismet_logging.log_types=kismet,pcapng
```

### Step 3: Periodic Sweep Scans

```bash
sudo airodump-ng wlan0mon -w sweep --output-format csv --write-interval 30
```

### Step 4: Alert on Unknown BSSIDs

Compare scan results against authorized baseline. Flag any unknown BSSID with matching SSID as high-priority (possible evil twin).

### Step 5: Wired-Side Confirmation

Correlate detected rogue AP MAC against switch port tables to locate physical connection.

### Step 6: Containment

Disable switch port, physically remove unauthorized AP, update incident log.

## Detection

```yaml
title: Rogue Access Points Detection
id: 6f8a75ac-be7e-4704-8c06-d5b76849771a
status: experimental
description: Detects suspicious activity related to detecting rogue access points techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1200
  - attack.t1584.007
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Rogue Access Points Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1200, T1584.007 |

## Verification

- [ ] Authorized AP baseline documented and current
- [ ] Kismet or equivalent WIDS running continuously
- [ ] Alerting configured for unknown BSSIDs
- [ ] Wired-side MAC correlation procedure established
- [ ] Rogue AP response procedure documented
- [ ] Periodic sweep scans scheduled

## References

- MITRE ATT&CK T1200 — Hardware Additions
- CIS Controls v8 Control 12: Network Infrastructure Management
- NIST SP 800-153: Guidelines for Securing WLANs
- [Kismet documentation](https://www.kismetwireless.net/docs/)
