<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-wireless-eavesdropping
description: >-
  Detection of wireless eavesdropping including monitor-mode sniffers, passive interception, encrypted traffic analysis, RF sweep procedures, and counter-surveillance techniques for wireless networks.
domain: cybersecurity
subdomain: wireless-security
tags:
  - wireless-eavesdrop
  - tscm
  - rf-sweep
  - counter-surveillance
  - wireless-forensics
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1040", "T1557", "T1020"]
  nist-csf: ["DE.CM-1", "DE.AE-3", "PR.DS-2"]
  uuid: 448207be-7dae-420f-80b6-6eaf0bcf892a
---

# Detecting Wireless Eavesdropping

## Overview

Wireless eavesdropping detection identifies unauthorized monitoring of wireless
communications. Passive sniffers in monitor mode leave minimal indicators, making
detection challenging. This technique covers RF environment surveying, client device
auditing, traffic analysis for data exfiltration, WIDS deployment for monitor-mode
device detection, and physical counter-surveillance measures.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Wireless adapter in monitor mode for RF surveying | Required |
| Kismet for passive device detection | Required |
| Spectrum analyzer (Wi-Spy or similar) | Required |
| Physical RF sweep equipment | Required |
| Network traffic analysis tools (tshark, zeek) | Required |

## Key Concepts

### Eavesdropping Detection Surface

```
Wireless Eavesdropping Detection:
├── RF Environment Analysis
│   ├── Baseline RF signature mapping
│   ├── Anomalous signal detection
│   ├── Unauthorized transmitter identification
│   └── Spectrum comparison analysis
├── Network-Level Detection
│   ├── Promiscuous mode device identification
│   ├── Traffic pattern anomaly detection
│   ├── Unexpected probe request monitoring
│   └── Data exfiltration indicators
├── Physical Counter-Surveillance
│   ├── Non-linear junction detection
│   ├── Near-field RF sweep
│   ├── Physical inspection of AP locations
│   └── Cable plant integrity verification
└── Encryption Verification
    ├── Unencrypted traffic identification
    ├── Downgrade attack detection
    ├── Certificate validation monitoring
    └── VPN tunnel integrity verification
```

### RF Environment Baseline

```bash
# Establish RF baseline with Kismet
kismet -c wlan0mon --log-prefix /var/log/kismet/rf_baseline \
  --log-types kismet,pcapng

# Automated device inventory from Kismet API
curl -s -k https://localhost:2501/devices/all_devices.json \
  -H "KISMET: $API_KEY" | \
  jq '.[] | {mac: .kismet_device_base_macaddr,
             type: .kismet_device_base_type,
             signal: .kismet_device_base_signal_dbm,
             packets: .kismet_device_base_packets_total}' \
  > rf_baseline_devices.json

# Periodic comparison against baseline
diff <(jq -r '.[].mac' rf_baseline_devices.json | sort) \
     <(curl -s -k https://localhost:2501/devices/all_devices.json \
       -H "KISMET: $API_KEY" | jq -r '.[].kismet_device_base_macaddr' | sort) \
  | grep "^>" | sed 's/^> /[NEW DEVICE] /'
```

### Passive Sniffer Detection

```bash
# Detect devices in monitor mode via unusual frame patterns
# Monitor-mode devices may leak frames when misconfigured
sudo tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x04" \
  -T fields -e wlan.sa -e wlan.ssid | sort -u

# Identify clients sending unusual volumes of probe requests
sudo tshark -i wlan0mon -a duration:300 \
  -Y "wlan.fc.type_subtype == 0x04" \
  -T fields -e wlan.sa | sort | uniq -c | sort -rn | \
  awk '$1 > 100 {print "[SUSPICIOUS] " $2 " sent " $1 " probes in 5 min"}'

# Check for unknown wireless adapters on trusted hosts
for host in $(cat /etc/wids/trusted_hosts.txt); do
  ssh $host "ip link show | grep -E 'wlan|mon'" 2>/dev/null | \
    while read line; do echo "[$host] $line"; done
done
```

### Traffic Exfiltration Detection

```bash
# Monitor for DNS exfiltration over wireless
sudo tshark -i wlan0 -Y "dns.qry.name matches \"[a-z0-9]{32,}\"" \
  -T fields -e ip.src -e dns.qry.name

# Detect unusual outbound traffic volumes per client
sudo tshark -i wlan0 -a duration:3600 -q -z conv,ip | \
  awk 'NR>6 && $6 > 100000000 {print "[HIGH VOLUME]", $1, "->", $3, "bytes:", $6}'

# Monitor for covert channel indicators
sudo zeek -i wlan0 -C local.zeek
cat conn.log | awk '$8 > 1000000 {print "Large flow:", $3, "->", $5, "bytes:", $8}'
```

## Workflow

### Step 1: RF Baseline

```bash
# Establish RF baseline for all monitored areas
kismet -c wlan0mon --log-prefix /var/log/kismet/baseline
```

### Step 2: Physical Sweep

Conduct physical RF sweep of sensitive areas for unauthorized transmitters.

### Step 3: Network Analysis

Monitor for promiscuous mode devices and traffic exfiltration indicators.

### Step 4: Encryption Audit

```bash
# Verify all wireless traffic is encrypted
sudo tshark -i wlan0mon -Y 'wlan.fc.protected == 0 && wlan.fc.type == 2' \
  -T fields -e wlan.sa -e wlan.da | sort -u
```

### Step 5: Reporting

Document findings and recommend counter-surveillance measures.

## Detection

```yaml
title: Wireless Eavesdropping Detection
id: 4e9cb3ed-6fd2-457c-80c8-ca0ab8346196
status: experimental
description: Detects suspicious activity related to detecting wireless eavesdropping techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1040
  - attack.t1557
  - attack.t1020
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wireless Eavesdropping Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1040, T1557, T1020 |

## Verification

- [ ] RF baseline established for all monitored areas
- [ ] Physical sweep completed for sensitive locations
- [ ] No unauthorized monitor-mode devices detected
- [ ] All wireless traffic confirmed encrypted
- [ ] Counter-surveillance recommendations documented

## References

- MITRE ATT&CK T1040 — Network Sniffing
- MITRE ATT&CK T1020 — Automated Exfiltration
- NIST SP 800-153 — Guidelines for Securing Wireless LANs
- [Kismet WIDS documentation](https://www.kismetwireless.net/docs/)
