tfMITRE ATT&CK technique

Adversary-in-the-Middle T1557

Tactics: Credential Access, Collection
Platforms: Linux, macOS, Network Devices, Windows
Version: 2.5
Created: 11 February 2020
Last modified: 12 May 2026
Contributors: Mayuresh Dani, Qualys; Daniil Yugoslavskiy, @yugoslavskiy, Atomic Threat Coverage project; NEC

Sub-techniques 431 rules across the family · 12 mapped directly to T1557 · 3 of 4 carry rules

.001Name Resolution Poisoning and SMB Relay15 .002ARP Cache Poisoning3 .003DHCP Spoofing1 .004Evil Twin0

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware66th pct

Tools & malware66th percentile · 63% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 21%

Detection rules79th percentile · 77% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Adversary-in-the-Middle T1557

Tactics: Credential Access, Collection
Platforms: Linux, macOS, Network Devices, Windows
Version: 2.5
Created: 11 February 2020
Last modified: 12 May 2026
Contributors: Mayuresh Dani, Qualys; Daniil Yugoslavskiy, @yugoslavskiy, Atomic Threat Coverage project; NEC

Sub-techniques 431 rules across the family · 12 mapped directly to T1557 · 3 of 4 carry rules

.001Name Resolution Poisoning and SMB Relay15 .002ARP Cache Poisoning3 .003DHCP Spoofing1 .004Evil Twin0

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware66th pct

Tools & malware66th percentile · 63% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 21%

Detection rules79th percentile · 77% of ATT&CK techniques have fewer detection rules written.

Adversary-in-the-Middle MITRE reference T1557

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Sea TurtleG1041 ↗

Modified DNS records at service providers to redirect traffic from legitimate resources to Sea Turtle-controlled servers to enable adversary-in-the-middle attacks for credential capture.1 2

created 2024-11-202 referencesaka Teal Kurma

Mustang PandaG0129 ↗

Leveraged a captive portal hijack that redirected the victim to a webpage that prompted the victim to download a malicious payload.1

created 2021-04-121 referenceaka TA416

KimsukyG0094 ↗

Has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.1

created 2019-08-261 referenceaka Black Banshee

All 3 groups for this technique

5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Kali365S9044 ↗

Has created obfuscated phishing landing pages that act as an adversary in the middle infrastructure that intercepts communications between the victim host and legitimate services to steal credentials and user sessions.1 2 3

created 2026-07-30MALWARE

evilginx2S9003 ↗

Has the ability to act as an adversary-in-the-middle (AiTM) relay between a legitimate website and a phished user to capture all transmitted data including usernames, passwords, authentication tokens, and session cookies and tokens.1 2 3 4

created 2026-01-30TOOL

Line RunnerS1188 ↗

Intercepts HTTP requests to the victim Cisco ASA, looking for a request with a 32-character, victim dependent parameter. If that parameter matches a value in the malware, a contained payload is then written to a Lua script and executed.1

created 2025-01-06MALWARE

NPPSPYS1131 ↗

Opens a new network listener for the mpnotify.exe process that is typically contacted by the Winlogon process in Windows. A new, alternative RPC channel is set up with a malicious DLL recording plaintext credentials entered into Winlogon, effectively intercepting and redirecting the logon information.1

created 2024-05-17TOOL

DokS0281 ↗

Proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.1 2

created 2018-10-17MALWARE

All 5 software entries for this technique

Data component	Name	Channel
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4663, 4670, 4656
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Field	What you tune
MonitoredRegistryPaths	Specific network stack and DNS registry keys that vary by enterprise configuration.
DowngradeCipherList	List of weak/legacy ciphers tuned per environment for TLS downgrade detection.
TimeWindow	Correlation period between config changes and abnormal network connections.

Data component	Name	Channel
File ModificationDC0061	auditd:SYSCALL	open, write
Network Traffic ContentDC0085	NSM:Flow	Unexpected ARP replies or DNS responses inconsistent with authoritative servers

Field	What you tune
MonitoredFiles	List of system files shaping traffic flow (hosts, resolv.conf, PAM modules).
ARPThreshold	Rate/volume thresholds for ARP/DNS anomalies tuned per subnet.

Data component	Name	Channel
Application Log ContentDC0038	macos:unifiedlog	Configuration profile modified or new profile installed
Network Traffic ContentDC0085	NSM:Flow	TLS downgrade or inconsistent DNS answers

Adversary-in-the-Middle T1557

Adversary-in-the-Middle T1557

Adversary-in-the-Middle MITRE reference T1557

Adversary-in-the-Middle MITRE reference T1557

Offense vs defense T1557

Adversary-in-the-Middle detection strategy DET0296

Detect Adversary-in-the-Middle via Network and Configuration Anomalies

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Adversary-in-the-Middle detections T1557

Adversary-in-the-Middle detections T1557

Field	What you tune
ProfileIdentifiers	Known good vs suspicious configuration profiles per enterprise baseline.
TLSVersionThreshold	Minimum TLS version accepted in network traffic inspection.

Data component	Name	Channel
File ModificationDC0061	networkdevice:config	Configuration file modified or replaced on network device
Network Traffic FlowDC0078	NSM:Flow	Unexpected route changes or duplicate gateway advertisements

Field	What you tune
RoutingPolicyBaseline	Expected routing and BGP/OSPF paths for validation.
FirmwareChecksum	Baseline image checksum per device type used to detect tampering.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios", indicating po (...)	Hunting	experimental	authentication	-	Azure Sign-in Logs · Azure	Credential Access, Collection Adversary-in-the-Middle	-	low	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-04-28	—	ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4
Splunk	This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access, Discovery Network Sniffing	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	7e9c3f8a-4b2d-4c5e-9a1f-6d8e5b3c2a9f
	Detects BGP failures which may be indicative of brute force attacks to manipulate routing	Generic	test	-	-	BGP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	56fa3cd6-f8d6-4520-a8c7-607292971886
	Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels	Generic	test	-	-	LDAP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	—	50e606bf-04ce-4ca7-9d54-3449494bbd4b
Splunk	The following analytic identifies the presence of unauthorized DHCP servers on the network. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-08-11	2026-05-13	6e1ada88-7a0d-4ac1-92c6-03d354686079	-
	Detects BGP failures which may be indicative of brute force attacks to manipulate routing.	Generic	test	-	-	BGP · Huawei	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	a557ffe6-ac54-43d2-ae69-158027082350
	Detects the configuration of a new ISATAP router on a Windows host. (...)	Generic	experimental	-	windows	WinEventLog System	Credential Access, Collection Adversary-in-the-Middle Impact Data Manipulation Transmitted Data Manipulation	-	medium	hamid	2025-10-19	—	d22df9cd-2aee-4089-93c7-9dc4eae77f2c
	Detects juniper BGP missing MD5 digest. (...)	Generic	test	-	-	BGP · Juniper	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
	Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. (...)	Generic	experimental	dns	windows	Sysmon	Credential Access, Collection Adversary-in-the-Middle Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-02-02	2026-03-16	2074e137-1b73-4e2d-88ba-5a3407dbdce0
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
	Detects suspicious child process creation by the Notepad++ updater process (gup.exe). (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-02-03	—	bb0e87ce-c89f-4857-84fa-095e4483e9cb
	Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. (...)	Generic	experimental	file_event	windows	Sysmon	Credential Access, Collection Adversary-in-the-Middle Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-02-03	2026-03-16	3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09