During a Red Team engagement, one must be aware of every action, even when it comes to Wi-Fi testing.
Sometimes, we have to send "deauthentication" packets to authenticated devices using tools like Aireplay-ng, in an attempt to capture a handshake and access the targeted network through Wi-Fi.
While defenders could quite easily monitor the deauth attacks using the following filter on Wireshark : wlan.fc.type_subtype == 12, sometimes attackers forget to use the appropriate options that could really enhance their OPSEC.
For example, there's two options "-h" and "-s" in Aireplay-ng that both allow us to specify the source MAC address, replacing it with the access point's MAC address to mimick a legitimate deauth packet sent by the router.