T1557.004 — Evil Twin

Tactics: Credential Access, Collection · Platforms: Network Devices

Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi…

Sub-technique of Adversary-in-the-Middle (T1557).

Sigma detection rules (1)

T1557.004 Adversary-in-the-Middle: Evil Twin

title: "T1557.004 Adversary-in-the-Middle: Evil Twin"
id: 4fedf2b9-a35c-4e4e-9d6a-d5b1e54e5bf5
description: 'Detect Evil Twin Wi-Fi Access Points on Network Devices. (Data Component: Network Traffic Flow; baseline tier: fallback.) Tune using: KnownSSIDs, AllowedBSSIDs, SignalStrengthThreshold, CaptivePortalDomains.'
references:
  - https://attack.mitre.org/techniques/T1557/004
author: Shahrukh Khan
date: 2026-05-11
license: MIT
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557.004

logsource:
  product: wlanlogs
  service: association

detection:
  selection:
    SSID: 'CorpWiFi'
    EncryptionType:
      - 'Open'
      - 'None'
      - 'WEP'

  condition: selection

falsepositives:
  - Guest or captive-portal networks legitimately using open authentication, and without a maintained known-good BSSID and encryption baseline for each corporate SSID this rule cannot reliably confirm a rogue access point.

level: medium

Related sub-techniques

Explore