Detecting and Mitigating Adversary-in-the-Middle Attacks (T1557)

Encryption protects traffic in transit, but only if the traffic actually goes where you think it goes. MITRE ATT&CK technique T1557, Adversary-in-the-Middle (AiTM), covers attackers who place themselves between two or more networked devices. The tactics are credential access and collection, and the platforms are Linux, macOS, Network Devices and Windows.

How attackers use it

The goal is a position in the path, which supports follow-on behavior such as Network Sniffing (T1040), Transmitted Data Manipulation (T1565.002) or replay attacks. MITRE says adversaries abuse features of common networking protocols that determine the flow of traffic, such as ARP, DNS and LLMNR, to force a device to communicate through an adversary controlled system.

MITRE lists several uses of the position:

• DNS manipulation. Changing victim DNS settings can block or redirect users away from legitimate sites, push additional malware, or intercept credentials, including access tokens and session cookies.
• Downgrade attacks. Negotiating a less secure, deprecated or weaker version of a protocol such as SSL/TLS, or a weaker encryption algorithm, to establish the position.
• Monitoring and modification. Reading traffic, or changing it in transit.
• Disruption. A similar position can stop traffic reaching its destination, to impair defenses or support a network denial of service.

There are two sub-techniques in this series with their own posts: Name Resolution Poisoning and SMB Relay (T1557.001) and ARP Cache Poisoning (T1557.002).

How to detect it

MITRE lists no data sources on this page. Signals follow from the protocols involved:

• Address resolution anomalies. One MAC address answering for many IP addresses, or the gateway's MAC changing.
• Name resolution responses from hosts that are not DNS servers, particularly to multicast name queries.
• DNS setting changes on endpoints, and DNS answers that differ from authoritative records.
• Certificate errors that cluster on one network segment or among one group of users.
• Protocol downgrade events, such as clients negotiating older TLS versions than the policy allows.
• Traffic paths that do not match the topology, shown in flow data.

Network intrusion detection tuned for these patterns is the most direct tool, and switches with dynamic ARP inspection add a preventive layer where supported.

How to reduce the risk

MITRE lists five mitigations.

1. Filter network traffic. Use network appliances and host based security software to block traffic that is not necessary, such as legacy protocols that can create AiTM conditions.
2. Encrypt sensitive information. Encrypt wired and wireless traffic appropriately, use best practices for authentication protocols such as Kerberos, and protect credential carrying web traffic with SSL/TLS.
3. Limit access to resources over the network. Restrict access to infrastructure that can reshape traffic.
4. Disable or remove features or programs. Turn off legacy network protocols that can be used to intercept traffic, especially those you do not need.
5. User training. Teach users to be suspicious of certificate errors, because adversaries may use their own certificates to intercept HTTPS traffic.

Think of these as layers. Disabling legacy name resolution removes a way in, encryption makes a position in the path far less useful, and certificate discipline turns the remaining attempts into visible errors.

Check your own environment

# Windows: show the ARP neighbor table
Get-NetNeighbor | Select-Object IPAddress, LinkLayerAddress, State, InterfaceAlias

# Windows: check whether multicast name resolution (LLMNR) is disabled by policy
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast

# Linux or macOS: show the ARP table
arp -a

# Linux or macOS: show DNS resolvers in use
cat /etc/resolv.conf

A value of 0 for EnableMulticast means LLMNR is disabled by policy. A missing value means the default applies, so check your Group Policy settings as well.

Review:

• Whether any two IP addresses share one MAC address in the ARP table, outside of known virtual setups.
• Which legacy name resolution protocols are enabled on your endpoints.
• Whether internal services still accept unencrypted or old TLS connections.

Quick check

Sources

• MITRE ATT&CK T1557 Adversary-in-the-Middle