Episode 54: Network-Based Indicators (Part 2) (Domain 2)

Continuing our focus on network-based threats, this episode explores wireless-specific attacks and credential replay tactics that compromise network integrity and user accounts. Wireless threats often begin with rogue access points or man-in-the-middle (MitM) setups, where attackers impersonate legitimate Wi-Fi networks to intercept traffic, steal credentials, or inject malicious payloads. Credential replay involves capturing valid authentication data—often through phishing or MitM attacks—and reusing it to gain unauthorized access, especially in systems that don’t enforce session uniqueness or multi-factor authentication. Indicators include duplicate SSIDs, unexpected device associations, frequent logins from a single source, or logins occurring outside expected geolocations. We also highlight the value of monitoring for certificate errors, session hijacking attempts, and access anomalies. Detecting these threats requires not just visibility, but intelligent alerting tied to user behavior and network conditions. Wireless security isn’t just about password strength—it’s about constant vigilance and knowing when “normal” starts to look suspicious.