<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-wifi-deauthentication-detection
description: >-
  Detect Wi-Fi deauthentication and disassociation attacks by monitoring 802.11 management frames, identifying flood patterns, and deploying Protected Management Frames (PMF).
domain: cybersecurity
subdomain: wireless-security
tags:
  - deauth-detection
  - pmf
  - 802.11w
  - wireless-dos
  - management-frames
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1499.002", "T1557.002"]
  nist-csf: ["DE.CM-1", "DE.AE-2", "PR.PT-4"]
  uuid: 64cbc442-8e34-4dee-8bdd-59bccdbbfa69
---

# Performing Wi-Fi Deauthentication Detection

## Overview

Deauthentication attacks exploit unprotected 802.11 management frames to forcibly disconnect
clients from access points. Detection monitors for deauth/disassoc frame floods, identifies
targeted vs. broadcast attacks, and correlates with handshake capture attempts. Mitigation
includes 802.11w Protected Management Frames (PMF) deployment.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Monitor-mode wireless adapter | Required |
| tshark/Wireshark for management frame analysis | Required |
| Kismet with deauth detection alerts | Required |
| APs supporting 802.11w PMF | Required |
| Baseline of normal deauth/disassoc rates | Required |

## Key Concepts

### Deauthentication Attack Patterns

```
Deauth Attack Types:
├── Broadcast deauth (all clients disconnected)
│   └── Reason code 7: Class 3 frame from non-associated STA
├── Targeted deauth (specific client)
│   └── Spoofed source = AP BSSID, destination = client MAC
├── Disassociation flood
│   └── Similar to deauth but uses disassoc frames
└── Combined with handshake capture
    └── Deauth + airodump-ng = forced 4-way handshake
```

### Deauth Frame Monitoring

```bash
# Monitor deauthentication frames
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x0c" \
  -T fields -e frame.time -e wlan.sa -e wlan.da -e wlan.fixed.reason_code

# Monitor disassociation frames
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x0a" \
  -T fields -e frame.time -e wlan.sa -e wlan.da -e wlan.fixed.reason_code

# Count deauth frames per second (flood detection)
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x0c" -q -z io,stat,1
```

### Flood Pattern Detection

```bash
# Alert on deauth flood (>10 frames/second from same source)
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x0c" \
  -T fields -e wlan.sa -e wlan.da | sort | uniq -c | sort -rn | head

# Detect broadcast deauth (destination ff:ff:ff:ff:ff:ff)
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x0c && wlan.da == ff:ff:ff:ff:ff:ff"
```

### PMF (802.11w) Deployment

```
Protected Management Frames:
├── Required: prevents deauth/disassoc spoofing
├── Configured per-SSID on AP:
│   ├── PMF Disabled — no protection (legacy)
│   ├── PMF Optional — clients can negotiate
│   └── PMF Required — management frames encrypted
├── hostapd config: ieee80211w=2 (required)
└── WPA3 mandates PMF — deploy WPA3 for full protection
```

## Workflow

### Step 1: Baseline Normal Rates

```bash
# Measure normal deauth rate over 1 hour
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x0c" -a duration:3600 -q -z io,stat,60
```

### Step 2: Deploy Monitoring

```bash
# Continuous deauth monitoring with alerts
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x0c || wlan.fc.type_subtype == 0x0a" \
  -w deauth_monitor.pcap
```

### Step 3: Configure Alerting

Set threshold alerts for deauth rates exceeding baseline by 3x standard deviation.

### Step 4: Enable PMF

Configure 802.11w on all APs. Set PMF required for WPA2/WPA3 networks.

### Step 5: Validate Detection

Run controlled deauth test and verify detection triggers correctly.

## Detection

```yaml
title: Wifi Deauthentication Detection Detection
id: 4e126f94-ae5b-4ead-8b3b-d702247d30b6
status: experimental
description: Detects suspicious activity related to performing wifi deauthentication detection techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1499.002
  - attack.t1557.002
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wifi Deauthentication Detection Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1499.002, T1557.002 |

## Verification

- [ ] Deauth frame monitoring active on all channels
- [ ] Alerting threshold configured for flood detection
- [ ] PMF (802.11w) enabled on all WPA2/WPA3 networks
- [ ] Controlled deauth test confirms detection
- [ ] Incident response procedure for deauth attacks
- [ ] Correlation with handshake capture attempts configured

## References

- IEEE 802.11w — Protected Management Frames
- MITRE ATT&CK T1499.002 — Service Exhaustion Flood
- Wi-Fi Alliance WPA3 Specification (mandates PMF)
- [Wireshark 802.11 display filters](https://wiki.wireshark.org/Wi-Fi)
