The usual equipment for this kind of test includes
Spectrum analyzer. A spectrum analyzer will be much more sensitive than an oscilloscope for detecting sinusoidal RF signals.
Anechoic chamber, or at least a Faraday cage. To ensure you measure only signals from the DUT, not from other devices nearby.
Calibrated source and antenna. To cover current cell phone bands, you need to test from about 800 to 2600 MHz.
To measure the actual attenuation provided by the enclosure you'd need to use both an anechoic chamber and a calibrated source antenna. You'd also want to have an antenna inside your enclosure that mimics the circuits you are worried about picking up the external signal.
None of this equipment is cheap. In my area, it commonly costs $1000's per day to rent test facilities for this kind of test.
The ability of the inside antenna to pick up signals from outside might depend strongly where the inside antenna is located within the enclosure. If you don't know exactly which traces on your inside circuit will be acting as antennas to pick up the external signal, you might rather do a radiated immunity test that measures how much power is required from the outside source to cause a failure of the actual circuit you want to put inside the enclosure.