Hi @swachchhanda000,

Thank you for the review.

Your idea to cover suspicious SSIDs is great. However, I think it should be separate because it covers a different type of attack and has a different severity level than Evil Twin AP. I would create a different rule based on your idea using SSIDs and keep my PR separate.

Hi @privet-username,

Thanks for this solid PR.

I made a few additional improvements on top of your original rule, including fixing some typos, expanding the detection logic to cover suspicious SSIDs and additional OUIs, and refining the metadata for better description and clarity.

Cheers!

Hi @swachchhanda000

I appreciate the effort, but I’ve reverted the changes related to SSIDs to keep this PR focused strictly on BSSID-based detection, as they represent different attack vectors and severity levels. I'll be happy to see the SSID logic as a separate PR.