Wireless intrusion detection: Finding rogue access points, evil twins and Wi-Fi attacks

Wireless attacks happen in the air, outside the view of firewalls and most network sensors, so an organisation without wireless intrusion detection usually learns about a rogue access point, an evil twin or an intruder on its Wi-Fi only after the damage is done. A wireless intrusion detection and prevention system (WIDS or WIPS) samples the radio bands around your sites, correlates what it hears with the wired network and raises alerts on unauthorised devices, impersonation and attacks against the protocol itself. This guide covers what a WIDS can and cannot see, sensor architecture, rogue and evil twin classification, the attacks worth alerting on, safe use of containment, integration with the SOC, metrics and rollout. It is written for network security engineers, wireless architects and SOC teams. For baseline Wi-Fi hardening, start with the Wi-Fi Security Guide.

Key takeaways

• Continuous monitoring is the baseline, not an extra. NIST SP 800-153 says organisations with WLANs should monitor continuously for rogue devices, misconfigurations, unusual usage, active scanners, denial of service and impersonation or man-in-the-middle attacks.
• Wired correlation is what turns noise into a finding. A neighbour's access point is not a rogue; an unknown access point plugged into your switch port is.
• A WIDS sees the protocol, not the application. NIST SP 800-94 notes that wireless IDPS cannot identify suspicious activity in higher-layer protocols, so pair it with network and endpoint detection.
• Protected Management Frames remove a whole attack class. WPA3 requires PMF, which stops forged deauthentication from disconnecting protected clients; alert on networks and clients still running without it.
• Wi-Fi credentials are identity credentials. The Nearest Neighbor attack reached an enterprise Wi-Fi network with valid domain credentials because Wi-Fi did not require MFA or certificates.

What wireless intrusion detection does and does not cover

NIST SP 800-94 treats wireless IDPS as one of four IDPS classes alongside network-based, network behaviour analysis and host-based systems. It monitors wireless traffic and analyses it for suspicious activity involving the wireless protocols themselves. NIST SP 800-153 lists the event classes a WLAN monitoring capability should detect.

Passive attackers who only listen cannot be detected by a WIDS. Strong encryption (WPA3, or WPA2 with 802.1X and EAP-TLS) is the control for eavesdropping. See the 802.1X and EAP-TLS Enterprise Wi-Fi Guide.

Sensor architecture

SP 800-153 describes three sensor forms: dedicated fixed or mobile sensors, monitoring features bundled into access points and wireless controllers, and host-based software on clients. The choice determines coverage and detection latency.

• Bands: cover 2.4 GHz, 5 GHz and, where your estate or attackers could use it, 6 GHz. A WIDS that scans only your operating bands misses rogues on the others.
• Location: SP 800-153 describes triangulation from signal strength at several sensors to locate a threat. Plan sensor density for location accuracy, not only detection.
• Sensor security: sensors are network devices with management credentials. Put them on a management network, use unique credentials and certificate-based enrolment, and patch them like access points.

Classifying rogues, neighbours and evil twins

Most WIDS alerts concern access points that are simply not yours. Classification rules decide whether the SOC sees thousands of alerts or a handful of real ones.

1. Authorised: your managed access points, identified by BSSID, controller registration or certificate.
2. Neighbour or external: access points heard over the air but with no evidence of connection to your network and not using your SSIDs. Record, do not alert.
3. Rogue (on-wire): an unmanaged access point or client bridge whose wireless or wired MAC address is seen on your switches, or whose traffic reaches your network. Highest priority.
4. Impersonation (evil twin or honeypot): an unmanaged access point advertising one of your SSIDs, or a spoofed BSSID of one of yours. High priority even if not on your wire, because it targets your users and their credentials.
5. Misconfigured authorised device: your access point broadcasting with the wrong security settings. Fix through configuration management.

Wired correlation works by comparing MAC addresses heard over the air with MAC address tables, DHCP leases and network access control records. Combine it with switch port security and 802.1X on wired ports so a rogue access point cannot get a working uplink. See the Network Access Control (NAC) Guide and, when one is found, the Rogue Device on Network Playbook.

Attacks and signals worth alerting on

The Wi-Fi Alliance states that WPA3 networks require Protected Management Frames and that PMF is required for all new certified devices. During migration, transition-mode networks still admit older clients, so keep alerting on associations without PMF. See the WPA3 Migration and Transition Mode Guide. For jamming, which no protocol setting prevents, see the Physical Layer and Wireless Jamming Guide.

Lessons from the Nearest Neighbor attack

Volexity's investigation of the attack it calls the Nearest Neighbor Attack, attributed to the group it tracks as GruesomeLarch (APT28), shows how Wi-Fi becomes an identity problem. In early 2022 the attacker password-sprayed a public-facing service to validate credentials; MFA blocked their use on internet services, but the target's enterprise Wi-Fi did not require MFA. The attacker compromised physically nearby organisations, found dual-homed systems with both wired and wireless connections, and used them to connect to the target's Wi-Fi with the valid credentials. Volexity recommends separating Wi-Fi and wired networks where wired networks reach sensitive resources, and requiring MFA or certificate-based authentication for Wi-Fi.

• Detection angle: a WIDS that baselines which client devices normally associate, and from where, could flag an unknown device associating from the building's edge. Correlate Wi-Fi associations with RADIUS logs and directory sign-ins.
• Identity angle: treat Wi-Fi authentication as part of your identity perimeter. Passwords that MFA protects on the internet should not grant network access over the air. See the APT28 (Fancy Bear) Threat Actor Profile.

Containment: when and how to prevent

WIPS products can contain a rogue by transmitting deauthentication frames at its clients or by shutting the switch port it uses. Wired-side containment is safe and effective; over-the-air containment transmits against devices that may belong to someone else.

• Prefer wired-side action: disable the switch port or quarantine the MAC address through NAC for confirmed on-wire rogues.
• Restrict over-the-air containment: apply it only to devices classified as on-wire rogues or as impersonating your SSIDs inside your premises, never to neighbours. Take legal advice before enabling automatic containment, because deliberately interfering with radio communications can breach radio regulations in many jurisdictions.
• Find and remove: SP 800-153 favours locating rogue devices rather than actively probing them, to avoid interacting with devices owned by others. Use location data and mobile scanners, then remove the device physically.
• Review automatic rules: log every containment action and review them weekly during the first months.

SOC integration and response

1. Forward events: send WIDS alerts, controller logs and RADIUS accounting to the SIEM with consistent device identifiers (BSSID, client MAC, sensor, location).
2. Enrich: join with NAC, DHCP and switch MAC tables to show whether the device is on the wire, and with the asset inventory to show who owns a client.
3. Triage by class: on-wire rogue and evil twin with client associations go to high priority; misconfigurations go to the network team as tickets.
4. Respond: locate, contain on the wire, remove, then check what the device reached. For evil twins, identify which users associated and reset their credentials if 802.1X validation was not enforced.
5. Preserve evidence: keep the WIDS event history, location estimates and the physical device for investigation. See the Network Forensics Guide.

Metrics

• Coverage: percentage of floor area and bands monitored continuously, from a site survey.
• Time to locate: median time from alert on an on-wire rogue to physical location.
• Time to contain: median time from alert to wired-side containment.
• Classification accuracy: share of high-priority alerts confirmed as real after triage.
• Legacy exposure: number of authorised SSIDs and clients operating without PMF or with pre-shared keys on corporate networks.
• Assessment cadence: SP 800-153 recommends periodic technical assessments at least annually, and at least quarterly unless continuous monitoring already gathers the data.

Implementation roadmap

1. Inventory authorised infrastructure: every SSID, BSSID, controller and sensor, with the expected security settings.
2. Enable monitoring in detect-only mode: start with AP-based scanning or dedicated radios across all bands; disable all automatic containment.
3. Tune classification: for two to four weeks, mark neighbours, confirm authorised devices and build wired correlation; measure alert volume.
4. Integrate with SIEM and NAC: forward events, enrich, write triage runbooks.
5. Add prevention gradually: wired-side containment for confirmed on-wire rogues first; over-the-air containment only in defined areas after legal review. Roll back by returning rules to detect-only.
6. Close root causes: enforce 802.1X on wired ports, remove PSK corporate SSIDs, require certificate-based or MFA-backed Wi-Fi authentication, enable PMF.
7. Test: plant an authorised test access point and a test evil twin during a scheduled exercise, and measure detection and response. See the Wireless Penetration Testing Guide.

Decision guidance

• Integrated versus overlay WIDS: AP-integrated monitoring suits most offices; dedicated overlay sensors suit high-security areas, sites that prohibit Wi-Fi, and estates where the wireless vendor's monitoring is limited.
• Small organisations: use the rogue detection built into your wireless platform, enable wired correlation and PMF, and run a quarterly walk-through scan of each site.
• Large or regulated estates: continuous monitoring on all bands, SIEM integration, documented containment policy and location-grade sensor density in sensitive areas.
• Wireless-free zones: if policy bans Wi-Fi in an area, you still need sensors there to prove the ban holds.

Common failure patterns

• Alert flood from neighbours: no classification, so real rogues are lost among hundreds of external access points.
• Monitoring only the bands in use: a rogue on 6 GHz or 2.4 GHz goes unseen because sensors scan only the operating band.
• Automatic containment against neighbours: legal and reputational exposure, and service disruption for others.
• Password-only Wi-Fi authentication: MFA protects internet services but not the network over the air, as the Nearest Neighbor attack showed.
• WIDS alerts outside the SOC: alerts sit in the wireless console and nobody triages them.
• No wired-port control: anyone can plug an access point into a meeting room port and get a working uplink.

Framework mapping

Practitioner checklist

• Record every authorised SSID, BSSID and expected security setting.
• Monitor all bands continuously, including 6 GHz where relevant.
• Correlate over-the-air MAC addresses with switch, DHCP and NAC data.
• Classify neighbours, rogues, impersonators and misconfigurations with distinct priorities.
• Forward WIDS and RADIUS events to the SIEM with triage runbooks.
• Prefer wired-side containment; get legal sign-off before over-the-air containment.
• Enable Protected Management Frames and alert on clients without it.
• Require certificate-based or MFA-backed Wi-Fi authentication and block dual connections on managed endpoints.
• Test detection with a planned evil twin and rogue at least once a year.

Standards and references

• NIST: SP 800-153 Guidelines for Securing Wireless Local Area Networks
• NIST: SP 800-94 Guide to Intrusion Detection and Prevention Systems
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• Wi-Fi Alliance: Wi-Fi Security (WPA3)
• MITRE ATT&CK: Evil Twin
• MITRE ATT&CK: Wi-Fi Networks
• Volexity: The Nearest Neighbor Attack

Related NHI Mgmt Group resources: Wi-Fi Security Guide · 802.1X and EAP-TLS Enterprise Wi-Fi Guide · Rogue Device on Network Playbook · Wireless Penetration Testing Guide