Detection Notes
Map wireless lab actions to defender signals — WIDS, RADIUS, AP logs on $LAB.
Visual · t15_detection_notes
Every lab action has a blue-team mirror. Original Cyberlium.
Red literacy without blue signals is incomplete.
Handshake labs → deauth detection and PMF. Rogue twin concepts → WIDS duplicate SSID alerts. Bluetooth pairing → MDM pairing logs. AP hardening → config drift alerts. Document signals for YOUR $LAB exercises — build defender vocabulary, not evasion recipes for production or neighbors.
1. Wi-Fi signals
Deauth/disassoc floods, duplicate SSID/BSSID pairs, auth failure spikes.
PMF blocks unsigned management frames on supported clients.
Command guide
Try these commands — Wi-Fi signals
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Wireless IDS concepts — https://www.wi-fi.org/discover-wi-fi/security Wireshark tutorials — https://www.wireshark.org/docs/wsug_html_chunked/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install tcpdump
macOS: Built-in
Windows: Use Wireshark or install via WSL
═══ LINUX / macOS ═══
Command — copy this
sudo tcpdump -i any -c 10 -n 2>/dev/null | tee /tmp/cyberlium-wifi-sample.log | head -5 || tcpdump -i any -c 5 -n 2>/dev/null | head -5 grep -cE 'IP|802.11|ARP' /tmp/cyberlium-wifi-sample.log 2>/dev/null || echo 'Write detection notes from YOUR lab capture'
Primary tools to practice this lesson: tcpdump, grep. Reference sites: Wireless IDS concepts (https://www.wi-fi.org/discover-wi-fi/security); Wireshark tutorials (https://www.wireshark.org/docs/wsug_html_chunked/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Enterprise signals
RADIUS reject bursts, cert mismatch events, NAC quarantine.
802.1X same user from multiple BSSIDs.
3. Bluetooth signals
Unexpected pairing, unknown BD_ADDR on corporate laptop.
BLE beacon anomalies in authorized venues — inventory, not exploit.
4. What you ship: wireless detection matrix
Three lab action types → defender signal mapping.
5. What you record before the next lesson
Detection matrix path.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Document signals only to evade WIDS on public nets.
- Right: Detection matrix for $LAB. Next: lab bring-up.
Mission: detection matrix
1) Map handshake lab to one signal. 2) Map rogue concept to one signal. 3) Map Bluetooth lab to one signal.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Example WIDS rogue rule?”
APPLY: Deauth floods trigger:
APPLY: True or False: Blue signals matter in this topic.
APPLY: Duplicate SSID alerts belong to: