Wireless Adversary Emulation

Definition

Wireless adversary emulation is the capstone discipline that assembles the wireless series — airspace recon (WI1), PSK capture (WI2), WPA3 posture (WI3), enterprise evil-twin surface (WI4), BLE inventory (WI5), SDR/RF estate (WI6), WIDS validation (WI7), mesh census (WI8), badge census (WI9) — into authorized engagements with the same architecture the T-series built: threat-profile-driven planning, tier-gated safety (passive-only → bench transmission → authorized airspace), manifest-tracked evidence, and per-phase telemetry contracts that feed the detection program. The wireless engagement differs from its building-network cousins in one structural way: the airspace is shared, so every transmission touches neighbors’ devices and every jurisdiction’s law — which makes the authorization architecture (what may transmit, where, when, against whom) the engagement’s engineering core rather than its paperwork. The deliverable is dual: the assessment findings (exposure measured, replay proven, census mapped) and the detection validation (WIDS coverage measured per WI7’s drill discipline), both landing in the program’s coverage matrix per T1/T10.

Why It Matters

Wireless is where engagement design matters most, because the medium is unbounded: a Wi-Fi attack respects VLANs; an RF attack crosses the parking lot, the neighboring floor, and the regulator’s attention. That unboundedness is why wireless engagements fail in two characteristic ways — under-tested (passive surveys only, transmission never authorized, so the replay and evil-twin surfaces stay theoretical) or over-reached (transmissions against devices the engagement doesn’t own, in airspace the engagement doesn’t control). The capstone’s job is making the middle path systematic: which surfaces validate passively (survey, census, posture), which validate with bench-gated transmission (owned devices in shielded spaces), and which justify authorized live-airspace work (twin drills, WIDS validation) — each tier with its evidence standard. For the organization, the wireless engagement is also the only exercise that reaches every perimeter at once: the Wi-Fi estate, the BLE population, the sub-GHz IoT estate, and the badge system — four perimeters that separate tools, budgets, and owners, measured in one engagement with one evidence chain. And the capstone closes the loop with the detection program: every wireless finding (replay window, twin acceptance, blind channel, legacy badge class) lands as a row in the T10 coverage matrix with its exact observable, which is how a one-week engagement keeps producing value across the quarters its fixes take to land.

Detailed Explanation

The engagement lifecycle maps each phase to its module, tier, and evidence:

 WIRELESS ENGAGEMENT LIFECYCLE
 [P0 PLAN]  threat profile + ROE + airspace authority
            tier assignment per technique:
              T0 passive (survey, census)     -> always
              T1 bench tx (owned devices)     -> isolated RF
              T2 live airspace (drills)       -> authorized window
            evidence: plan doc + authorization refs
 [P1 RECON] passive-only, multi-window (WI1 lessons)
            survey + BLE inventory + RF sweep + badge census
            evidence: survey JSONs, window diffs
 [P2 POSTURE] passive analysis of captured material
            PSK/WPA3 posture, mesh encryption ratio,
            badge tech census, WIDS baseline read
            evidence: analyzer reports (WI1-9 tools)
 [P3 DRILL] tier-gated transmission
            bench: replay, pairing, GATT (T1 tier)
            live: twin drill, WIDS shapes (T2 tier)
            evidence: drill manifests + widsdiffer coverage
 [P4 REPORT] layered reporting per T10
            findings + detection validation + backlog rows
            evidence: report + coverage matrix update

The tier architecture is the module’s engineering core, inherited and specialized from T1: tier 0 (passive) needs only airspace access and is invisible to WIDS; tier 1 (bench transmission) needs owned devices in RF-isolated space — a Faraday-setup, shielded lab, or at minimum a channel and time where no foreign device can receive; tier 2 (live airspace) needs the written authorization that names which SSIDs may be targeted, which clients may be deauthed, which channels may be used, and when — because the twin that lures an unauthorized neighbor’s laptop is a different incident than the one that lures yours. The multi-window discipline (WI1’s ⚠️ lesson institutionalized) applies to every passive phase: populations have schedules, and the survey that ran Tuesday afternoon missed the three networks that only exist on Saturday. The evidence chain treats RF like any other forensic domain: every capture file hashes into the manifest, every analyzer output cites its capture, every drill event cites its manifest entry — because a wireless finding (“the twin was accepted”) is only as good as the frames that prove it. The detection-validation split (P3’s second purpose) separates attack validation (does the attack work?) from detection validation (did the WIDS see it?) — the same event carries both measurements, and conflating them is how programs report attacks without knowing whether anyone would have noticed. The legal architecture deserves its own line in every phase: receive freely (passive), transmit only on authority, never jam, never touch third-party devices — the four rules that keep the engagement an assessment.

Common Techniques

Engagement technique	Tier	Module source	Evidence artifact
Multi-window airspace survey	T0	WI1	Survey JSONs + window diffs
BLE device census	T0	WI5	Inventory JSONs + tracker flags
Sub-GHz sweep + census	T0	WI6	Band occupancy + burst catalog
Badge technology census	T0	WI9	meta.csv + reader log audit
WPA3/PSK posture analysis	T0	WI2/WI3	RSN parse + migration report
Mesh census + freshness	T0	WI8	PAN membership + guard state
Handshake capture (authorized)	T2	WI2	Validated capture + crack timeline
Evil-twin drill	T2	WI4	Twin manifest + harvest evidence
WIDS evasion drill	T2	WI7	Drill manifest + coverage matrix
Replay/relay demonstrations	T1	WI6/WI9	Bench video + reader logs
GATT/pairing assessment	T1	WI5	Per-device profile reports
Hub/API assessment	T0	WI8	API findings + credential posture

Full Working Code

wirengage.py — the wireless engagement orchestrator: manages the P0-P4 lifecycle with the authorization gate (tier-2 phases refuse without an APPR- reference and a channel/SSID scope list), tracks every phase’s evidence artifacts into a manifest (with hashes), validates the tier gates before each phase, and generates the engagement report skeleton that feeds T10’s reporting. stdlib only.

#!/usr/bin/env python3
"""wirengage.py — wireless engagement lifecycle orchestrator.
Usage:
  python wirengage.py --phase plan --title "Q4 wireless"
  python wirengage.py --phase recon --title "Q4 wireless"
  python wirengage.py --phase drill --title "Q4 wireless" \
      --authorized APPR-2026-118 --channels 6,44 \
      --ssids LabCorp-Corp --tier2
  python wirengage.py --phase report --title "Q4 wireless"
Manifest: wirengage_manifest.json — every artifact hashed.
stdlib only.
"""
import argparse, hashlib, json, os, sys, datetime

MANIFEST = "wirengage_manifest.json"
PHASES = ["plan", "recon", "posture", "drill", "report"]

def load_manifest():
    if os.path.exists(MANIFEST):
        return json.load(open(MANIFEST, encoding="utf-8"))
    return {"title": None, "phases": {}, "artifacts": []}

def save(m):
    json.dump(m, open(MANIFEST, "w"), indent=2)

def hash_file(path):
    h = hashlib.sha256()
    with open(path, "rb") as fh:
        for chunk in iter(lambda: fh.read(65536), b""):
            h.update(chunk)
    return h.hexdigest()[:16]

def add_artifact(m, path, phase, note=""):
    if not os.path.exists(path):
        print(f"[!] artifact missing: {path}")
        return
    m["artifacts"].append({
        "phase": phase, "path": path,
        "sha16": hash_file(path),
        "note": note,
        "when": datetime.datetime.now(
            datetime.timezone.utc).isoformat()})
    print(f"[+] artifact: {path} ({phase})")

def gate_t2(args, phase):
    """Tier-2 gate: authorization + scope required."""
    if not args.authorized or not args.authorized.startswith(
            "APPR-"):
        return "tier-2 phase requires --authorized APPR-ref"
    if not args.channels or not args.ssids:
        return "tier-2 phase requires --channels and --ssids"
    return None

def phase_plan(m, args):
    m["title"] = args.title
    plan = {
        "phases": PHASES,
        "tiers": {"plan": 0, "recon": 0, "posture": 0,
                  "drill": 2 if args.tier2 else 1,
                  "report": 0},
        "authorized": args.authorized,
        "channels": args.channels,
        "ssids": args.ssids,
        "started": datetime.datetime.now(
            datetime.timezone.utc).isoformat()}
    m["phases"]["plan"] = {"status": "done",
                           "detail": plan}
    path = "engagement_plan.json"
    json.dump(plan, open(path, "w"), indent=2)
    add_artifact(m, path, "plan", "ROE/scope skeleton")
    return True

def phase_recon(m, args):
    print("""[*] recon phase — tier 0 (passive only):
  1. multi-window survey (WI1): >=2 day-parts
  2. BLE inventory (WI5): hcidump windows
  3. sub-GHz sweep (WI6): 315/433/868/915
  4. badge census (WI9): PACS metadata export
Record artifact paths below as produced:""")
    for p in input("artifacts (comma-sep): ").split(","):
        p = p.strip()
        if p:
            add_artifact(m, p, "recon")
    m["phases"]["recon"] = {"status": "done"}
    return True

def phase_drill(m, args):
    gate = gate_t2(args, "drill")
    if gate:
        print(f"[REFUSED] {gate}")
        m["phases"]["drill"] = {"status": "refused",
                                "reason": gate}
        save(m)
        return False
    print(f"""[*] drill phase — tier 2 (authorized:
  {args.authorized}, channels {args.channels},
  ssids {args.ssids}):
  shapes: paced-deauth | cloned-beacon | twin-harvest
  manifest every frame + widsdiffer afterward""")
    for p in input("drill artifacts (comma-sep): ").split(","):
        p = p.strip()
        if p:
            add_artifact(m, p, "drill",
                         f"auth={args.authorized}")
    m["phases"]["drill"] = {
        "status": "done", "authorized": args.authorized,
        "channels": args.channels, "ssids": args.ssids}
    return True

def phase_report(m, args):
    rows = ["# Wireless engagement — evidence manifest", ""]
    for a in m["artifacts"]:
        rows.append(f"- [{a['phase']}] `{a['path']}` "
                    f"sha16={a['sha16']} {a['note']}")
    rows += ["", "## Coverage matrix handoff (T10)", "",
             "- shapes detected: (widsdiffer output)",
             "- findings: (per-module reports)",
             "- backlog rows: (gap tickets with observables)"]
    path = f"{args.title.replace(' ', '_')}_report.md"
    open(path, "w").write("\n".join(rows) + "\n")
    m["phases"]["report"] = {"status": "done"}
    add_artifact(m, path, "report", "engagement report")
    return True

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--phase", required=True,
                    choices=PHASES)
    ap.add_argument("--title", required=True)
    ap.add_argument("--authorized")
    ap.add_argument("--channels")
    ap.add_argument("--ssids")
    ap.add_argument("--tier2", action="store_true")
    args = ap.parse_args()
    m = load_manifest()
    fn = {"plan": phase_plan, "recon": phase_recon,
          "drill": phase_drill, "report": phase_report}
    if args.phase == "posture":
        print("[*] posture phase — passive analysis of "
              "P1 captures with WI1-9 analyzers; add "
              "reports as artifacts:")
        for p in input("artifacts (comma-sep): ").split(","):
            p = p.strip()
            if p:
                add_artifact(m, p, "posture")
        m["phases"]["posture"] = {"status": "done"}
        ok = True
    else:
        ok = fn[args.phase](m, args)
    save(m)
    print(f"[+] manifest: {len(m['artifacts'])} artifacts "
          f"across {len(m['phases'])} phases")

if __name__ == "__main__":
    main()

Code Walkthrough

• The tier-2 gate (lines 40-49) is the engagement’s legal architecture in code: the drill phase refuses to run without an APPR- reference plus explicit channel and SSID scope — and it records the refusal in the manifest (lines 92-95), so a refused attempt is itself evidence of the control working.
• The manifest model (lines 24-36) hashes every artifact at registration (SHA-16 of file contents) — the evidence chain’s integrity: a capture cited in the report can be verified against the manifest’s hash months later, the wireless version of the forensic exhibit chain.
• The phase functions (lines 52-101) encode each phase’s human workflow: plan writes the ROE/scope skeleton (tier map, authorization refs), recon names the four passive workstreams with their module sources, drill prints the shape list and demands artifacts, report generates the markdown that carries the manifest into T10’s reporting stack.
• The interactive artifact collection (lines 68-71, 84-87, 113-117) is deliberately simple — the orchestrator is the checklist and evidence ledger, not a tool executor; the WI1-9 tools do the work, the orchestrator binds their outputs into the evidence chain. That separation keeps the orchestrator honest: it tracks what was produced, it cannot claim what wasn’t.

How It Reaches The Target

The engagement reaches the target estate through its four perimeters in one evidence chain: the Wi-Fi airspace (survey → posture → drills), the BLE population (inventory → tracker flags), the sub-GHz estate (sweep → replay classing), and the badge system (census → clone/relay tests) — each perimeter’s findings landing in the same manifest, the same report, the same coverage matrix. The tier gates reach the risk conversation as the engagement’s credibility: passive findings with passive evidence, bench findings with bench evidence, live-airspace findings with authorization refs — an auditor or a nervous CISO can trace every claim to its tier and its artifact hash. The drill phase reaches the WIDS estate as WI7’s coverage matrix rows, the harvest phase reaches the identity program as the supplicant-hygiene worklist (WI4), the census reaches procurement as the IoT and badge migration lists (WI8/WI9), and the replay findings reach facilities as the protocol-classification conversation (WI6). The report reaches T10’s stack as its wireless rows: validated shapes, blind shapes, findings with observables, backlog items with owners — the wireless program becomes a row-family in the same governance that tracks malware detections, which is the integration that makes wireless security stay fixed after the engagement ends. And the manifest reaches the next engagement as its baseline: the previous cycle’s artifacts are this cycle’s diffs — the airspace, the BLE population, the badge census, and the mesh all change over quarters, and the engagement-to-engagement diff is the standing metric that makes the program a program.

Exploitation Chain

1. Plan — tier map, authorization APPR-2026-118, channels 6+44, SSIDs scoped, ROE skeleton filed
2. Recon — multi-window survey (2 day-parts), BLE census, sub-GHz sweep, badge census: 4 evidence artifacts
3. Posture — analyzers run on captures: 9 transition-mode SSIDs, 60% Classic badges, 2 fixed-code devices, 3 probe-leaking clients
4. Bench — replay + pairing + GATT assessments on owned devices (tier 1, shielded): 2 replay wins, 1 HID pairing gap
5. Drill — tier-2 live: twin on scoped SSID/channels, paced deauth, WIDS shapes; manifest records every frame
6. Correlate — widsdiffer: 2/5 shapes detected; sensorcover: channel 44 blind
7. Report — layered report + coverage matrix rows: 11 findings, 5 detection gaps, backlog with observables
8. Close — manifest archived (hashed evidence), re-engagement scheduled next quarter as diff baseline

Building Your Own Tool

airspace.py — the multi-window airspace baseline tool: diffs survey JSONs across capture windows (WI1’s lesson institutionalized) — new/vanished APs and clients per window pair, day-part stability classification (present-always vs window-only), and the baseline JSON that rogue detection (WI4’s roguecheck) consumes. stdlib only.

Design decisions

• Window pairs, not one survey. The unit of analysis is the pair (window A vs window B): an AP present in both windows is stable inventory; present in one is window-only (schedule-dependent — the survey that missed it lies); the classification is per-AP, not per-survey.
• Clients diff by class. Client MACs churn (RPA); the diff classifies client churn separately (new client MACs are normal; new probe SSIDs are signal) — the privacy-aware client diff.
• Baseline = stable set. Only window-stable APs enter the rogue-detection baseline; window-only APs get flagged for a third window before inventory decisions — patience as a design property.
• JSON in, JSON out. Consumes wifiscan.py outputs directly; emits the baseline shape roguecheck expects — the WI1→WI4 pipeline, joined.

Full source

#!/usr/bin/env python3
"""airspace.py — multi-window airspace baseline differ.
Usage:
  python airspace.py winA.json winB.json [--json base.json]
Inputs: wifiscan.py survey JSONs (aps/clients shape).
stdlib only.
"""
import argparse, json, sys

def aps_of(survey):
    out = {}
    for bssid, rec in survey.get("aps", {}).items():
        out[bssid] = {"ssid": rec.get("ssid"),
                      "channel": rec.get("channel"),
                      "frames": rec.get("frames", 0)}
    return out

def probes_of(survey):
    out = {}
    for mac, rec in survey.get("clients", {}).items():
        if rec.get("probes"):
            out[mac] = set(rec["probes"])
    return out

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("winA")
    ap.add_argument("winB")
    ap.add_argument("--json")
    args = ap.parse_args()
    a = json.load(open(args.winA, encoding="utf-8"))
    b = json.load(open(args.winB, encoding="utf-8"))
    apA, apB = aps_of(a), aps_of(b)
    stable = {k: v for k, v in apA.items() if k in apB}
    only_a = {k: v for k, v in apA.items()
              if k not in apB}
    only_b = {k: v for k, v in apB.items()
              if k not in apA}
    print(f"== airspace diff ==")
    print(f"stable APs (both windows): {len(stable)}")
    print(f"window-A-only: {len(only_a)}")
    print(f"window-B-only: {len(only_b)}")
    for k, v in sorted(only_b.items()):
        print(f"  NEW in B: {k} "
              f"ssid={v['ssid'] or '<hidden>'} "
              f"ch={v['channel']}")
    baseline = {"stable": stable,
                "watchlist": {k: v for k, v in
                              only_b.items()}}
    # client probe diff (privacy-aware)
    prA, prB = probes_of(a), probes_of(b)
    new_probes = {}
    for mac, probes in prB.items():
        old = prA.get(mac)
        if old is None:
            new_probes[mac] = sorted(probes)
        else:
            fresh = probes - old
            if fresh:
                new_probes[mac] = sorted(fresh)
    if new_probes:
        print(f"\nnew probe SSIDs this window:")
        for mac, probes in list(new_probes.items())[:8]:
            print(f"  {mac}: {', '.join(probes[:4])}")
    if args.json:
        json.dump(baseline, open(args.json, "w"),
                  indent=2)
        print(f"[+] baseline -> {args.json} "
              f"(feed roguecheck --inventory)")

if __name__ == "__main__":
    main()

Walkthrough

• The stability classification (lines 27-33) is the tool’s whole idea: APs present in both windows are baseline material; APs in one window only go to the watchlist, not the baseline — the rogue detector that consumes this baseline inherits the patience, and stops flagging the neighbor’s Saturday-only router.
• The client probe diff (lines 38-48) is privacy-aware by design: client MAC churn is expected (RPA), so the diff reports new probe SSIDs rather than new MACs — the signal (a device started probing for a network it didn’t before) survives the privacy feature that kills naive client diffs.
• The baseline output shape (lines 51-53) matches roguecheck’s inventory expectations — the two tools chain directly, and the comment in the output says so; the WI1 survey → airspace baseline → WI4 rogue check pipeline is three commands, not a project.

Compilation and test procedure

two survey windows, one week apart, different day-parts

$ python wifiscan.py tue_afternoon.cap —json winA.json $ python wifiscan.py sat_morning.cap —json winB.json

$ python airspace.py winA.json winB.json —json base.json == airspace diff == stable APs (both windows): 34 window-A-only: 5 window-B-only: 3 NEW in B: 9c:3d:cf:xx:xx:09 ssid=LabCorp-Corp ch=6 new probe SSIDs this window: 3c:5a:b4:xx:xx:0f: LabCorp-Guest

the Saturday-only ‘LabCorp-Corp’ on a new BSSID goes to the

watchlist -> roguecheck flags it HIGH next sweep

engagement lifecycle across the quarter

$ python wirengage.py —phase plan —title “Q4 wireless” $ python wirengage.py —phase recon —title “Q4 wireless” artifacts (comma-sep): winA.json,winB.json,ble_inv.json,rf_sweep.json $ python wirengage.py —phase drill —title “Q4 wireless”
—authorized APPR-2026-118 —channels 6,44
—ssids LabCorp-Corp —tier2 $ python wirengage.py —phase report —title “Q4 wireless” [+] manifest: 11 artifacts across 5 phases

Detection considerations

The engagement’s detection outputs land in three places: the WIDS coverage matrix (WI7’s rows — which evasion shapes fire which rules), the inventory baselines (airspace, BLE, badge, mesh — what rogue/clone/anomaly detection consumes), and the correlation rules (the joins that survive evasion: source-inventory, physics, position, identity-history). Your own tooling hygiene: the orchestrator and differ are passive bookkeeping; every transmission step is tier-gated with its authorization ref in the manifest — the engagement’s legal posture is queryable from its own evidence file. The vendor conversation closes the loop: share the blind-shape findings with WIDS vendors (their rules need your deployment’s data), require drills as procurement acceptance tests, and keep one passive drill shape running monthly so the coverage line trends between engagements. Wazuh/SIEM mapping of the wireless evidence chain [verify per deployment] makes the manifest queryable alongside every other program’s artifacts — the single governance surface the whole handbook converges on. The standing metric that proves the program: finding-closure rate across engagements — the fraction of last cycle’s findings validated fixed this cycle; it is the wireless program’s regression-test pass rate, and it is the only number that shows the estate’s radio posture improving rather than just being measured.

Improvements to add

1. Manifest signing: HMAC the manifest with an engagement key so the evidence chain is tamper-evident across handoffs.
2. Diff automation: quarterly scheduled airspace/BLE/badge diffs with SIEM-facing JSON (the standing baseline pipeline).
3. Findings tracker join: emit findings directly into the T10 gap-debt schema with owners and ages.
4. Scope automation: parse the authorization PDF’s scope fields into the tier-2 gate (channels/SSIDs from the doc, not the CLI).
5. Perimeter completeness check: warn at plan time if any of the four perimeters (Wi-Fi/BLE/sub-GHz/badge) has no planned phase — the capstone’s own coverage matrix.

Detection — Defender View

Artifact	Consumer	Cadence	Notes
Engagement report + manifest	Program governance	Per engagement	Hashed evidence chain
Coverage matrix wireless rows	T10 reporting stack	Per engagement	Detected vs blind shapes
Airspace baseline	roguecheck / WIDS	Quarterly	Stable-set discipline
BLE device-class inventory	Policy + safety	Quarterly	HID/tracker counts
Badge technology census	Migration program	Quarterly	Legacy percentage trend
Mesh PAN-membership diff	IoT governance	Quarterly	Commissioning audit
Sub-GHz protocol classification	Facilities/procurement	Per engagement	Fixed/rolling/authenticated
WIDS blind channels	Sensor planning	Per drill	Placement findings
Supplicant hygiene worklist	Endpoint team	Per engagement	Identity-leak fleet
Finding-closure rate	Leadership	Trend	The program’s pass rate

Evasion Techniques

The engagement-layer “evasion” is the adversary’s engagement discipline — the operational patterns that make real adversaries hard to engage with your defenses. Schedule discipline: adversaries survey at your quietest hours and drill during your noisiest (shift changes, maintenance windows), exploiting exactly the population-schedule blindness the multi-window survey exists to fix. Infrastructure rotation at engagement cadence: twins, beacons, and harvest infrastructure that exist for hours — countered by continuous baselines (the quarterly census becomes weekly when it feeds automated diffs) and by the physics checks that survive rotation (same-BSSID-two-channels, position anomalies). Multi-perimeter patience: attackers who touch only the badge system for months, then only BLE, keeping each layer’s anomaly below every single-layer threshold — countered by the capstone’s own integration: one evidence chain across four perimeters makes cross-layer patterns visible (a badge clone whose UID first appeared in a BLE inventory anomaly). Legal-boundary discipline on their side: adversaries who stay strictly passive are nearly undetectable by design — countered by accepting that passive reconnaissance cannot be detected, only its downstream effects (the harvest, the replay, the join) can, which is why the detection investment belongs at the effects. Attribution hygiene: tooling that rotates fingerprints per engagement so your drill-trained SOC meets unfamiliar shapes — countered by training on shape classes (pacing, cloning, coverage) rather than tool signatures, which is exactly what this module’s drills validate. The structural lesson that closes the wireless series: the engagement program’s value is not the findings it produces this quarter — it is that the estate’s radio posture becomes measured, baselined, and diffed on a schedule the adversary’s patience cannot outlast.

⚠️ What caught me: my first wireless engagement ran flawlessly for four days — and then the client’s facilities manager called, not about the findings, but about the elevator: my sub-GHz sweep had recorded bursts at 433 MHz during a window when the building’s own elevator telemetry was doing a firmware update, and their vendor’s monitoring had flagged my receiver’s location as “unexplained RF activity” on their logs. Nobody was in trouble — but the engagement had generated a third-party incident I hadn’t planned for, and my manifest had no entry for “who else watches the bands I’m sweeping.” The runbook change was immediate: every engagement plan now inventories who else monitors the frequencies and airspaces in scope (building vendors, neighboring tenants, the landlord’s own WIDS), notifies them through the client, and logs their acknowledgment in the manifest. The airspace is shared by defenders too — an engagement that surprises them is measuring a distracted estate, and the surprise is your finding.

Lab Practice

1. Run the full lifecycle on your lab airspace: plan → recon (2 windows) → posture → bench drill → report — with wirengage.py binding every artifact; your first end-to-end wireless engagement file.
2. Build the airspace baseline across a real two-week window pair and feed it to roguecheck.py; introduce an authorized twin and confirm the watchlist→HIGH flow — the WI1→WI4 pipeline, proven end to end.
3. Execute the capstone’s own completeness check (improvement #5): plan an engagement, deliberately omit the badge phase, and verify the orchestrator warns — then add it and confirm the four-perimeter coverage.
4. Test the tier-2 gate: attempt the drill phase without authorization arguments, confirm the refusal and its manifest record — then authorize and proceed; the gate working is the engagement’s legal architecture, demonstrated.
5. Diff two engagements: archive the manifest, run a second engagement next month, and produce the finding-closure rate from the two reports — the program metric that turns one-off assessments into a governance loop.

Interview Questions

• Technical: Map the four RF perimeters (Wi-Fi, BLE, sub-GHz, badge) to their recon, posture, and drill techniques — what does each perimeter’s tier-0 assessment cover?
• Technical: Why does the tier architecture (passive/bench/live) exist as engineering rather than policy, and what does each tier’s evidence standard require?
• Scenario: Your engagement’s sub-GHz sweep triggers a neighbor vendor’s RF monitoring. What went wrong in planning, and what does the runbook become?
• Conceptual: Why is the multi-window survey a correctness requirement rather than a best-effort nicety?
• Conceptual: How does the engagement-to-engagement diff turn assessments into a governance program — and what metric proves the loop?
• Deep-dive: Design the capstone engagement for a 3-building campus: perimeters, phases, tiers, evidence, staffing, and the detection-validation deliverable.
• Practical: Leadership funds one wireless initiative from your report. What do you recommend first, what evidence carries it, and what does the next engagement prove?

Related Modules

T1 (ATT&CK Mapping & Emulation Planning) · WI1 (Wireless Fundamentals & Recon (802.11)) · WI4 (Enterprise Wi-Fi & Evil Twin) · WI7 (Wireless IDS Evasion) · T10 (Emulation Reporting & Metrics)