<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-wireless-client-attacks
description: >-
  Detection and defense against wireless client-side attacks including evil twin APs, KARMA attacks, deauthentication floods, client probing exploitation, and captive portal credential theft.
domain: cybersecurity
subdomain: wireless-security
tags:
  - wireless-ids
  - evil-twin
  - karma
  - deauth-detection
  - wips
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.002", "T1200", "T1557"]
  nist-csf: ["DE.CM-1", "DE.AE-2", "PR.AC-5"]
  uuid: e997ab1c-de6b-410f-a553-30e828c295b6
---

# Detecting Wireless Client Attacks

## Overview

Wireless client attacks exploit trust relationships between devices and access points.
Evil twin APs, KARMA/MANA attacks, and deauthentication floods target the client association
process. This technique covers detection strategies using Kismet, airodump-ng, waidps, and
custom monitoring to identify rogue APs, unauthorized deauthentication, and suspicious client
behavior patterns.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Wireless adapter in monitor mode (dedicated sensor) | Required |
| Kismet wireless IDS/network detector | Required |
| waidps (Wireless Auditing, Intrusion Detection & Prevention System) | Required |
| airodump-ng for baseline AP enumeration | Required |
| SIEM integration for alert correlation | Required |

## Key Concepts

### Client Attack Detection Surface

```
Wireless Client Attack Detection:
├── Rogue AP Detection
│   ├── BSSID/SSID mismatch monitoring
│   ├── Signal strength anomaly detection
│   ├── Beacon interval analysis
│   └── Certificate mismatch (WPA-Enterprise)
├── Deauthentication Detection
│   ├── Deauth frame rate monitoring
│   ├── Source MAC validation
│   ├── Targeted vs. broadcast deauth patterns
│   └── PMF enforcement verification
├── KARMA/MANA Detection
│   ├── Probe response to all SSIDs
│   ├── AP responding to non-existent SSIDs
│   ├── Rapid SSID advertisement changes
│   └── Client association anomalies
└── Captive Portal Abuse
    ├── HTTP redirect monitoring
    ├── SSL stripping detection
    └── DNS hijacking indicators
```

### Kismet Wireless IDS Configuration

```bash
# Start Kismet in IDS mode with logging
kismet -c wlan0mon --override wardrive --no-ncurses \
  --log-types kismet,pcapng --log-prefix /var/log/kismet/ids

# Configure alert thresholds in kismet_site.conf
cat >> /etc/kismet/kismet_site.conf << EOF
alert=DEAUTHFLOOD,10/min,1/sec
alert=BSSTIMESTAMP,5/min,1/sec
alert=APSPOOF,5/min,1/sec
alert=MSFBCOMSSID,5/min,1/sec
alert=DISASSOCTRAFFIC,10/min,1/sec
EOF

# Monitor Kismet alerts in real-time
kismet_client --filter-alerts
```

### Deauthentication Flood Detection

```bash
# Monitor for deauth frame bursts with airodump-ng
sudo airodump-ng wlan0mon -w deauth_monitor --output-format pcap

# Analyze deauth frequency per BSSID
tshark -r deauth_monitor-01.cap \
  -Y "wlan.fc.type_subtype == 0x0c || wlan.fc.type_subtype == 0x0a" \
  -T fields -e frame.time -e wlan.sa -e wlan.da -e wlan.bssid | \
  sort | uniq -c | sort -rn | head -20

# Detect deauth targeting specific clients
tshark -r deauth_monitor-01.cap \
  -Y "wlan.fc.type_subtype == 0x0c && wlan.da != ff:ff:ff:ff:ff:ff" \
  -T fields -e wlan.sa -e wlan.da | sort | uniq -c | sort -rn
```

### Evil Twin / Rogue AP Detection

```bash
# Build authorized AP baseline
sudo airodump-ng wlan0mon --band abg -w baseline --output-format csv
# Parse and store known-good BSSIDs
awk -F',' '/^[0-9A-F]/{print $1,$14}' baseline-01.csv > authorized_aps.txt

# Continuous monitoring for unauthorized APs
while true; do
  sudo timeout 30 airodump-ng wlan0mon --band abg -w scan --output-format csv 2>/dev/null
  comm -13 <(sort authorized_aps.txt) <(awk -F',' '/^[0-9A-F]/{print $1,$14}' scan-01.csv | sort) | \
    while read line; do
      echo "[ALERT] Unauthorized AP detected: $line" | logger -t wids
    done
  rm -f scan-01.csv
  sleep 60
done
```

## Workflow

### Step 1: Baseline Establishment

```bash
# Enumerate all authorized APs and store baseline
sudo airodump-ng --band abg wlan0mon -w baseline --output-format csv
sleep 120 && kill %1
awk -F',' '/^[0-9A-F]/{print $1,$6,$14}' baseline-01.csv > /etc/wids/authorized_aps.conf
```

### Step 2: Sensor Deployment

Deploy dedicated monitor-mode adapters on each floor/zone for full coverage.

### Step 3: Alert Configuration

```bash
# Configure Kismet alerting
kismet -c wlan0mon --alert-backlog 500 --log-types alert
```

### Step 4: Continuous Monitoring

Run detection loops for deauth floods, rogue APs, and KARMA indicators.

### Step 5: Alert Triage

Cross-reference alerts with authorized AP inventory and SIEM correlation rules.

## Detection

```yaml
title: Wireless Client Attacks Detection
id: 0d35bc94-a33a-4227-bcd9-abc613455667
status: experimental
description: Detects suspicious activity related to detecting wireless client attacks techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1557.002
  - attack.t1200
  - attack.t1557
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wireless Client Attacks Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.002, T1200, T1557 |

## Verification

- [ ] Authorized AP baseline documented and maintained
- [ ] Kismet IDS alerts configured for all attack categories
- [ ] Deauthentication flood detection threshold validated
- [ ] Evil twin detection tested with known rogue AP
- [ ] Alert pipeline to SIEM verified end-to-end

## References

- MITRE ATT&CK T1557.002 — ARP Cache Poisoning
- MITRE ATT&CK T1200 — Hardware Additions
- CIS Controls v8 — 12.1 Maintain Wireless Network Inventory
- [Kismet documentation](https://www.kismetwireless.net/docs/)
