Deauth Attack Pattern - Forced Wi-Fi Reconnect
This rule detects a Deauthentication (Deauth) attack pattern, specifically targeting forced Wi-Fi reconnections. It triggers an alert when a high volume (50 or more) of TCP SYN packets are observed from a single source IP address within a 5-second window directed towards the home network. This pattern is indicative of an attacker attempting to flood a Wi-Fi network with deauthentication frames, forcing legitimate clients to disconnect and then reconnect, which can be exploited for various malicious purposes like capturing handshakes or facilitating man-in-the-middle attacks.
Suricata
