1. Home
  2. ATT&CK Techniques
  3. T1557 Adversary-in-the-Middle

T1557 Adversary-in-the-Middle Mappings

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)

Adversaries may leverage the AiTM position to attempt to modify traffic, such as in Transmitted Data Manipulation. Adversaries can also stop traffic from flowing to the appropriate destination, causing denial of service.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-16 Security and Privacy Attributes Protects T1557 Adversary-in-the-Middle
AC-17 Remote Access Protects T1557 Adversary-in-the-Middle
AC-18 Wireless Access Protects T1557 Adversary-in-the-Middle
AC-19 Access Control for Mobile Devices Protects T1557 Adversary-in-the-Middle
AC-20 Use of External Systems Protects T1557 Adversary-in-the-Middle
AC-3 Access Enforcement Protects T1557 Adversary-in-the-Middle
AC-4 Information Flow Enforcement Protects T1557 Adversary-in-the-Middle
CA-7 Continuous Monitoring Protects T1557 Adversary-in-the-Middle
CM-2 Baseline Configuration Protects T1557 Adversary-in-the-Middle
CM-6 Configuration Settings Protects T1557 Adversary-in-the-Middle
CM-7 Least Functionality Protects T1557 Adversary-in-the-Middle
CM-8 System Component Inventory Protects T1557 Adversary-in-the-Middle
RA-5 Vulnerability Monitoring and Scanning Protects T1557 Adversary-in-the-Middle
SC-23 Session Authenticity Protects T1557 Adversary-in-the-Middle
SC-4 Information in Shared System Resources Protects T1557 Adversary-in-the-Middle
SC-46 Cross Domain Policy Enforcement Protects T1557 Adversary-in-the-Middle
SC-7 Boundary Protection Protects T1557 Adversary-in-the-Middle
SC-8 Transmission Confidentiality and Integrity Protects T1557 Adversary-in-the-Middle
SI-10 Information Input Validation Protects T1557 Adversary-in-the-Middle
SI-12 Information Management and Retention Protects T1557 Adversary-in-the-Middle
SI-15 Information Output Filtering Protects T1557 Adversary-in-the-Middle
SI-3 Malicious Code Protection Protects T1557 Adversary-in-the-Middle
SI-4 System Monitoring Protects T1557 Adversary-in-the-Middle
SI-7 Software, Firmware, and Information Integrity Protects T1557 Adversary-in-the-Middle

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1557.002 ARP Cache Poisoning 22
T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay 15