<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-evil-twin-attacks
description: >-
  Detect evil twin and AP impersonation attacks using BSSID fingerprinting, signal strength analysis, certificate validation, and 802.11 beacon frame inspection.
domain: cybersecurity
subdomain: wireless-security
tags:
  - evil-twin
  - ap-impersonation
  - wireless-defense
  - beacon-analysis
  - wids
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.002", "T1584.007"]
  nist-csf: ["DE.CM-1", "DE.AE-2", "PR.AC-5"]
  uuid: d653ffb9-7c22-4745-ab8d-00e4c07678e7
---

# Detecting Evil Twin Attacks

## Overview

Evil twin attacks impersonate legitimate access points to intercept client traffic. Detection
relies on multiple signals: duplicate SSID detection, BSSID fingerprinting inconsistencies,
signal strength anomalies, beacon frame analysis, 802.1X certificate mismatch detection,
and clock skew analysis. Effective detection requires correlation of multiple indicators.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Monitor-mode wireless adapter | Required |
| Kismet or custom scanning scripts | Required |
| Authorized AP inventory with BSSID, channel, and signal baseline | Required |
| 802.1X certificate fingerprint database (for enterprise) | Required |
| tshark/Wireshark for 802.11 frame analysis | Required |

## Key Concepts

### Evil Twin Detection Signals

```
Detection Indicators:
├── Duplicate SSID with unknown BSSID
├── Same SSID on unexpected channel
├── Signal strength anomaly (stronger than known AP)
├── Beacon interval mismatch
├── Different RSN/WPA capabilities than legitimate AP
├── Certificate mismatch (802.1X environments)
├── Clock skew difference in TSF timestamps
└── OUI mismatch (AP vendor inconsistency)
```

### Beacon Frame Analysis

```bash
# Capture beacon frames with tshark
tshark -i wlan0mon -f "type mgt subtype beacon" \
  -T fields -e wlan.sa -e wlan.ssid -e wlan.ds.current_channel \
  -e wlan.fixed.beacon -e wlan.rsn.pcs.type

# Filter for specific SSID to find duplicates
tshark -i wlan0mon -Y 'wlan.ssid == "CorpWiFi"' \
  -T fields -e wlan.sa -e wlan.ds.current_channel -e radiotap.dbm_antsignal
```

### Signal Strength Comparison

```bash
# Monitor signal strength for BSSID over time
sudo airodump-ng wlan0mon --bssid $LEGIT_BSSID -c $CHANNEL 2>&1 | \
  awk '/PWR/{print strftime("%T"), $0}'

# Compare with suspected evil twin
# Legitimate AP: consistent signal from known location
# Evil twin: different signal characteristics, may be stronger
```

### TSF Clock Skew Analysis

```bash
# Extract TSF timestamps from beacon frames
tshark -i wlan0mon -Y 'wlan.ssid == "CorpWiFi"' \
  -T fields -e wlan.sa -e wlan.fixed.timestamp

# Different hardware = different clock drift patterns
# Same SSID with different TSF skew = different physical device
```

## Workflow

### Step 1: Baseline Authorized APs

Document all legitimate APs: BSSID, SSID, channel, expected signal range, beacon interval.

### Step 2: Continuous SSID Monitoring

```bash
# Monitor for duplicate SSIDs
sudo airodump-ng wlan0mon --essid "CorpWiFi" -w evil_twin_scan
```

### Step 3: Multi-Signal Correlation

Compare detected APs against baseline using BSSID, channel, signal, and beacon parameters.

### Step 4: Certificate Validation (Enterprise)

For 802.1X networks, monitor for certificate fingerprint changes during EAP authentication.

### Step 5: Alert and Contain

Trigger alert on high-confidence evil twin detection. Deauth clients from rogue AP if WIPS enabled.

### Step 6: Forensic Capture

```bash
tshark -i wlan0mon -f "ether host $ROGUE_BSSID" -w evil_twin_capture.pcap
```

## Detection

```yaml
title: Evil Twin Attacks Detection
id: b69efc5e-98a5-44ef-8907-8fd97644cea8
status: experimental
description: Detects suspicious activity related to detecting evil twin attacks techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1557.002
  - attack.t1584.007
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Evil Twin Attacks Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.002, T1584.007 |

## Verification

- [ ] Authorized AP baseline includes BSSID, channel, signal range
- [ ] Duplicate SSID detection active and alerting
- [ ] Beacon frame analysis configured for anomaly detection
- [ ] 802.1X certificate pinning deployed (enterprise)
- [ ] Evil twin response procedure documented
- [ ] Detection tested with controlled evil twin exercise

## References

- MITRE ATT&CK T1557.002 — ARP Cache Poisoning
- MITRE ATT&CK T1584.007 — Serverless Infrastructure
- NIST SP 800-153: Guidelines for Securing WLANs
- IEEE 802.11-2020 Beacon Frame Specification
