Adversary-in-the-Middle

T1557

Technique with 4 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.

Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.

Detection rules30

Rules on DetectionCode tagged with T1557 or one of its sub-techniques.

Sigma20

Rule	Level	Log source	Technique
Potential SMB Relay Attack Tool Execution	critical	windows / process_creation	T1557.001
Attempts of Kerberos Coercion Via DNS SPN Spoofing	high	windows / process_creation	T1557.001
HackTool - ADCSPwn Execution	high	windows / process_creation	T1557.001
HackTool - Impacket Tools Execution	high	windows / process_creation	T1557.001
Local Privilege Escalation Indicator TabTip	high	windows / NULL	T1557.001
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation	high	windows / NULL	T1557.003
RottenPotato Like Attack Pattern	high	windows / NULL	T1557.001
Suspicious Child Process of Notepad++ Updater - GUP.Exe	high	windows / process_creation	T1557
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing	high	windows / dns_query	T1557.001
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network	high	zeek / NULL	T1557.001
Uncommon File Created by Notepad++ Updater Gup.EXE	high	windows / file_event	T1557
WinDivert Driver Load	high	windows / driver_load	T1557.001
ISATAP Router Address Was Set	medium	windows / NULL	T1557
Notepad++ Updater DNS Query to Uncommon Domains	medium	windows / dns_query	T1557
Potential PetitPotam Attack Via EFS RPC Calls	medium	zeek / NULL	T1557.001
Potential Suspicious Activity Using SeCEdit	medium	windows / process_creation	T1557
Cisco BGP Authentication Failures	low	cisco / NULL	T1557
Cisco LDP Authentication Failures	low	cisco / NULL	T1557
Huawei BGP Authentication Failures	low	huawei / NULL	T1557
Juniper BGP Missing MD5	low	juniper / NULL	T1557

Splunk10

Rule	Type	Risk	Data source	Technique
Cisco ASA - Packet Capture Activity	Anomaly	NULL	Cisco ASA Logs	T1557
Detect ARP Poisoning	TTP	NULL	Cisco IOS Logs	T1557.002
Detect IPv6 Network Infrastructure Threats	TTP	NULL	Cisco IOS Logs	T1557.002
Detect Port Security Violation	TTP	NULL	Cisco IOS Logs	T1557.002
Detect Rogue DHCP Server	TTP	NULL	Cisco IOS Logs	T1557
DNS Kerberos Coercion	TTP	NULL	Suricata, Sysmon EventID 22	T1557.001
Windows Credential Target Information Structure in Commandline	TTP	NULL	Sysmon EventID 1	T1557.001
Windows Kerberos Coercion via DNS	TTP	NULL	Windows Event Log Security 4662, Windows Event Log Security 5136, Windows Event Log Security 5137	T1557.001
Windows Short Lived DNS Record	TTP	NULL	Windows Event Log Security 5136, Windows Event Log Security 5137	T1557.001
Windows Theme File Creation in Unusual Location	Anomaly	NULL	Sysmon EventID 11	T1557.001

Sub-techniques4

ID	Name	Examples
T1557.001	Name Resolution Poisoning and SMB Relay	7
T1557.002	ARP Cache Poisoning	2
T1557.003	DHCP Spoofing	0
T1557.004	Evil Twin	1

Groups3

Software5

Dok evilginx2 Kali365 Line Runner NPPSPY

Campaigns1

ArcaneDoor

Procedure examples9

Groups3

Used by	Procedure example
GroupKimsuky	Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website. CISA AA20-301A Kimsuky
GroupMustang Panda	Mustang Panda leveraged a captive portal hijack that redirected the victim to a webpage that prompted the victim to download a malicious payload. Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025
GroupSea Turtle	Sea Turtle modified DNS records at service providers to redirect traffic from legitimate resources to Sea Turtle-controlled servers to enable adversary-in-the-middle attacks for credential capture. Talos Sea Turtle 2019 Talos Sea Turtle 2019_2

Software5

Used by	Procedure example
MalwareDok	Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic. CheckPoint Dok objsee mac malware 2017
Toolevilginx2	evilginx2 has the ability to act as an adversary-in-the-middle (AiTM) relay between a legitimate website and a phished user to capture all transmitted data including usernames, passwords, authentication tokens, and session cookies and tokens. Breakdev Evilginx 3.0 May 2023 Breakdev Evilginx 3.2 AUG 2023 Evilginx 2 July 2018 Sophos Evilginx MAR 2025
MalwareKali365	Kali365 has created obfuscated phishing landing pages that act as an adversary in the middle infrastructure that intercepts communications between the victim host and legitimate services to steal credentials and user sessions. Artic Wolf Kali365 Device Code OAuth June 2026 Artic Wolf Labs Kali365 Device Code April 2026 SpyCloud Kali365 June 2026
MalwareLine Runner	Line Runner intercepts HTTP requests to the victim Cisco ASA, looking for a request with a 32-character, victim dependent parameter. If that parameter matches a value in the malware, a contained payload is then written to a Lua script and executed. Cisco ArcaneDoor 2024
ToolNPPSPY	NPPSPY opens a new network listener for the `mpnotify.exe` process that is typically contacted by the Winlogon process in Windows. A new, alternative RPC channel is set up with a malicious DLL recording plaintext credentials entered into Winlogon, effectively intercepting and redirecting the logon information. Huntress NPPSPY 2022

Campaigns1

Used by	Procedure example
CampaignArcaneDoor	ArcaneDoor included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device. Cisco ArcaneDoor 2024

References9

Rapid7 MiTM Basics Open source
Rapid7. (n.d.). Man-in-the-Middle (MITM) Attacks. Retrieved March 2, 2020.
Token tactics Open source
Microsoft Incident Response. (2022, November 16). Token tactics: How to prevent, detect, and respond to cloud token theft. Retrieved December 26, 2023.
ad_blocker_with_miner Open source
Kuzmenko, A.. (2021, March 10). Ad blocker with miner included. Retrieved October 28, 2021.
dns_changer_trojans Open source
Abendan, O. (2012, June 14). How DNS Changer Trojans Direct Users to Threats. Retrieved October 28, 2021.
mitm_tls_downgrade_att Open source
praetorian Editorial Team. (2014, August 19). Man-in-the-Middle TLS Protocol Downgrade Attack. Retrieved December 8, 2021.
taxonomy_downgrade_att_tls Open source
Alashwali, E. S., Rasmussen, K. (2019, January 26). What's in a Downgrade? A Taxonomy of Downgrade Attacks in the TLS Protocol and Application Protocols Using TLS. Retrieved December 7, 2021.
tlseminar_downgrade_att Open source
Team Cinnamon. (2017, February 3). Downgrade Attacks. Retrieved December 9, 2021.
ttint_rat Open source
Tu, L. Ma, Y. Ye, G. (2020, October 1). Ttint: An IoT Remote Access Trojan spread through 2 0-day vulnerabilities. Retrieved October 28, 2021.
volexity_0day_sophos_FW Open source
Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.