Techniques › T1557
T1557 Adversary-in-the-Middle
credential access · collection — Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
10
Sigma rules tagged attack.t1557
4
KEV CVEs mapped here
<p>Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.</p><p>For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.</p><p>Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-31201 | Apple Multiple Products | secondary impact | Stale | 2025-04-17 |
| CVE-2025-31200 | Apple Multiple Products | secondary impact | Stale | 2025-04-17 |
| CVE-2022-1040 | Sophos Firewall | secondary impact | Mapped | 2022-03-31 |
| CVE-2019-5591 | Fortinet FortiOS | primary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0296 Detect Adversary-in-the-Middle via Network and Configuration Anomalies v1.0
AN0823 WindowsDetects suspicious DNS/ARP poisoning attempts, unauthorized modifications to registry/network configuration, or abnormal TLS downgrade activity. Correlates changes in system configuration with subsequent unusual network flows or authentication events.Tunable:
MonitoredRegistryPathsDowngradeCipherListTimeWindowAN0824 LinuxDetects unauthorized edits to /etc/hosts, /etc/resolv.conf, or suspicious ARP broadcasts. Correlates file modifications with subsequent unexpected network sessions or service creation.NSM:FlowUnexpected ARP replies or DNS responses inconsistent with authoritative servers→ DC0085 Network Traffic ContentTunable:MonitoredFilesARPThresholdAN0825 macOSDetects unauthorized edits to system configuration profiles, unexpected certificate trust changes, or abnormal ARP/DNS patterns indicative of interception.macos:unifiedlogConfiguration profile modified or new profile installed→ DC0038 Application Log ContentTunable:ProfileIdentifiersTLSVersionThresholdAN0826 Network DevicesDetects unauthorized firmware or configuration changes enabling adversary-in-the-middle positioning (e.g., route injection, DNS spoofing, SSL downgrade). Behavioral analytics focus on sudden changes to routing tables or image file integrity failures.networkdevice:configConfiguration file modified or replaced on network device→ DC0061 File ModificationTunable:RoutingPolicyBaselineFirmwareChecksum
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1557
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-02 (modified 2026-03-16) · logsource: product=windows category=dns_query · 2074e137-1b73-4e2d-88ba-5a3407dbdce0
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-03 (modified 2026-03-16) · logsource: product=windows category=file_event · 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Author: Tim Brown
· 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=huawei service=bgp · a557ffe6-ac54-43d2-ae69-158027082350
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=juniper service=bgp · a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-03 · logsource: product=windows category=process_creation · bb0e87ce-c89f-4857-84fa-095e4483e9cb
Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
This could indicate potential exploitation of the updater component to deliver unwanted malware.
Author: Janantha Marasinghe
· 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Author: hamid
· 2025-10-19 · logsource: product=windows service=system · d22df9cd-2aee-4089-93c7-9dc4eae77f2c
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-04-28 · logsource: product=azure service=signinlogs · ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4
Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios",
indicating potential use of automated credential harvesting or AiTM phishing infrastructure.
Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens.
When triaging results, analysts should:
- Check the sign-in risk level, MFA status, and conditional access results for signs of bypass.
- Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts.
- Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.