DET0726 Detection of Wireless Compromise

Technique Detected: T0860 (Wireless Compromise)

Analytics

ICS

AN1859

Monitor login sessions for new or unexpected devices or sessions on wireless networks. Monitor application logs for new or unexpected devices or sessions on wireless networks. New or irregular network traffic flows may indicate potentially unwanted devices or sessions on wireless networks. In Wi-Fi networks monitor for changes such as rogue access points or low signal strength, indicating a device is further away from the access point then expected and changes in the physical layer signal.(Citation: Nzyme Alerts Intro) (Citation: Wireless Intrusion Detection) Network traffic content will provide important context, such as hardware (e.g., MAC) addresses, user accounts, and types of messages sent.

Log Sources

Mutable Elements