| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| action.malware.variety.AiTM | Man-in-the-middle attack. Child of 'Exploit vuln'. | related-to | T1557 | Adversary-in-the-Middle |
| action.malware.variety.AiTM | Man-in-the-middle attack. Child of 'Exploit vuln'. | related-to | T1557.001 | LLMNR/NBT-NS Poisoning and SMB Relay |
| action.malware.variety.AiTM | Man-in-the-middle attack. Child of 'Exploit vuln'. | related-to | T1557.002 | ARP Cache Poisoning |
| action.malware.variety.AiTM | Man-in-the-middle attack. Child of 'Exploit vuln'. | related-to | T1557.003 | DHCP Spoofing |