Sea TurtleG1041 ↗
Modified DNS records at service providers to redirect traffic from legitimate resources to Sea Turtle-controlled servers to enable adversary-in-the-middle attacks for credential capture.12
tfMITRE ATT&CK technique
Adversary-in-the-Middle T1557
- Tactics
- Credential Access, Collection
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 2.5
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributors
- Mayuresh Dani, Qualys; Daniil Yugoslavskiy, @yugoslavskiy, Atomic Threat Coverage project; NEC
Sub-techniques 431 rules across the family · 12 mapped directly to T1557 · 3 of 4 carry rules
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.5
Tools & malware66th pct
Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Adversary-in-the-Middle MITRE reference T1557
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Mustang PandaG0129 ↗
Leveraged a captive portal hijack that redirected the victim to a webpage that prompted the victim to download a malicious payload.1
KimsukyG0094 ↗
Has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.1
All 3 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
ArcaneDoorC0046 ↗
Included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device.1
All 1 campaigns for this technique
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has created obfuscated phishing landing pages that act as an adversary in the middle infrastructure that intercepts communications between the victim host and legitimate services to steal credentials and user sessions.123
evilginx2S9003 ↗
Has the ability to act as an adversary-in-the-middle (AiTM) relay between a legitimate website and a phished user to capture all transmitted data including usernames, passwords, authentication tokens, and session cookies and tokens.1234
Line RunnerS1188 ↗
Intercepts HTTP requests to the victim Cisco ASA, looking for a request with a 32-character, victim dependent parameter. If that parameter matches a value in the malware, a contained payload is then written to a Lua script and executed.1
NPPSPYS1131 ↗
Opens a new network listener for the mpnotify.exe process that is typically contacted by the Winlogon process in Windows. A new, alternative RPC channel is set up with a malicious DLL recording plaintext credentials entered into Winlogon, effectively intercepting and redirecting the logon information.1
DokS0281 ↗
Proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.12
All 5 software entries for this technique
Offense vs defense T1557
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 10Splunk ESCU (cumulative) · 2
first rule: 2020 Q3 · 1 of 1 campaigns plottedAdversary-in-the-Middle detection strategy DET0296
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Adversary-in-the-Middle via Network and Configuration Anomalies
4 platforms
AN0823 · Windows
Detects suspicious DNS/ARP poisoning attempts, unauthorized modifications to registry/network configuration, or abnormal TLS downgrade activity. Correlates changes in system configuration with subsequent unusual network flows or authentication events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredRegistryPaths | Specific network stack and DNS registry keys that vary by enterprise configuration. |
| DowngradeCipherList | List of weak/legacy ciphers tuned per environment for TLS downgrade detection. |
| TimeWindow | Correlation period between config changes and abnormal network connections. |
AN0824 · Linux
Detects unauthorized edits to /etc/hosts, /etc/resolv.conf, or suspicious ARP broadcasts. Correlates file modifications with subsequent unexpected network sessions or service creation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | auditd:SYSCALL | open, write |
| Network Traffic ContentDC0085 | NSM:Flow | Unexpected ARP replies or DNS responses inconsistent with authoritative servers |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredFiles | List of system files shaping traffic flow (hosts, resolv.conf, PAM modules). |
| ARPThreshold | Rate/volume thresholds for ARP/DNS anomalies tuned per subnet. |
AN0825 · macOS
Detects unauthorized edits to system configuration profiles, unexpected certificate trust changes, or abnormal ARP/DNS patterns indicative of interception.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | macos:unifiedlog | Configuration profile modified or new profile installed |
| Network Traffic ContentDC0085 | NSM:Flow | TLS downgrade or inconsistent DNS answers |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProfileIdentifiers | Known good vs suspicious configuration profiles per enterprise baseline. |
| TLSVersionThreshold | Minimum TLS version accepted in network traffic inspection. |
AN0826 · Network Devices
Detects unauthorized firmware or configuration changes enabling adversary-in-the-middle positioning (e.g., route injection, DNS spoofing, SSL downgrade). Behavioral analytics focus on sudden changes to routing tables or image file integrity failures.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | networkdevice:config | Configuration file modified or replaced on network device |
| Network Traffic FlowDC0078 | NSM:Flow | Unexpected route changes or duplicate gateway advertisements |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RoutingPolicyBaseline | Expected routing and BGP/OSPF paths for validation. |
| FirmwareChecksum | Baseline image checksum per device type used to detect tampering. |
Disable legacy network protocols that may be used to intercept network traffic if applicable, especially those that are not needed within an environment.
Ensure that all wired and/or wireless traffic is encrypted appropriately. Use best practices for authentication protocols, such as Kerberos, and ensure web traffic that may contain credentials is protected by SSL/TLS.
Use network appliances and host-based security software to block network traffic that is not necessary within the environment, such as legacy protocols that may be leveraged for AiTM conditions.
Limit access to network infrastructure and resources that can be used to reshape traffic or otherwise produce AiTM conditions.
Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.
Network SegmentationM1030
Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.
User TrainingM1017
Train users to be suspicious about certificate errors. Adversaries may use their own certificates in an attempt to intercept HTTPS traffic. Certificate errors may arise when the application’s certificate does not match the one expected by the host.