An attacker who sits between a client and the service it trusts can capture hashes, relay authentication and rewrite traffic without ever cracking a password. MITRE ATT&CK tracks this as T1557 Adversary-in-the-Middle (AiTM), placed in both the Credential Access (TA0006) and Collection (TA0009) tactics, with four sub-techniques: name resolution poisoning and SMB relay, ARP cache poisoning, DHCP spoofing and evil twin Wi-Fi. This guide covers T1557 as it stands in ATT&CK v20 (technique version 2.5), turns its five detection strategies into log sources and rules, and explains which identity and protocol settings make interception worthless. It is for network and Windows security engineers, detection engineers and identity teams. The web-proxy form of AiTM used in phishing kits is covered separately in the AiTM Phishing Guide; this page is about the network-layer technique ATT&CK files under T1557.
Key takeaways
- Position first, credentials second. T1557 is about gaining a position on the path; the payoff is follow-on behaviour such as T1040 Network Sniffing, relay of NTLM authentication or T1565.002 Transmitted Data Manipulation.
- Legacy name resolution is the cheapest win. LLMNR (UDP 5355) and NBT-NS (UDP 137) answer broadcast lookups from anyone; disabling them removes the most common internal T1557.001 path.
- Relay only works when authentication is not bound to the channel. SMB signing, LDAP signing and channel binding, and Extended Protection for Authentication on HTTP services stop relayed NTLM from being accepted.
- Layer 2 controls belong on the switch. DHCP snooping and Dynamic ARP Inspection block T1557.002 and T1557.003 at the access port, where host-based detection only sees the aftermath.
- Machine and service accounts are prime relay targets. Coerced authentication from servers and domain controllers turns AiTM into domain compromise, so treat computer accounts as privileged NHIs.
How T1557 works in ATT&CK v20
ATT&CK describes adversaries positioning themselves between networked devices to support sniffing, data manipulation or replay, and notes that the position can also be used to downgrade connections, block traffic to security services or redirect users. Platforms are Linux, macOS, Windows and Network Devices.
| Sub-technique | How the position is gained | What the attacker gets | Primary fix |
|---|---|---|---|
| T1557.001 Name Resolution Poisoning and SMB Relay | Answering LLMNR, NBT-NS or mDNS lookups for names that DNS could not resolve | NetNTLM challenge responses to crack or relay to SMB, LDAP or HTTP services | Disable LLMNR and NBT-NS; require SMB signing; LDAP signing and channel binding |
| T1557.002 ARP Cache Poisoning | Forged ARP replies that map the gateway or a server IP to the attacker's MAC address | All traffic between victims on the same segment | Dynamic ARP Inspection, segmentation, encryption in transit |
| T1557.003 DHCP Spoofing | A rogue DHCP server handing out attacker-controlled DNS servers or gateways | Redirected name resolution and traffic for every client that accepts the lease | DHCP snooping with trusted ports, authorised DHCP servers in AD |
| T1557.004 Evil Twin | A rogue access point broadcasting a legitimate SSID, often with a captive portal | Wi-Fi credentials, captive portal logins, unencrypted traffic | 802.1X with EAP-TLS and server certificate validation, wireless IDS |
ATT&CK v20 links T1557 or its sub-techniques to groups including APT28 (G0007), Lazarus Group (G0032), Kimsuky (G0094), Wizard Spider (G0102), Mustang Panda (G0129) and Sea Turtle (G1041). Related credential techniques to chain in hunting are T1187 Forced Authentication, which coerces a host to authenticate to the attacker, and T1550.002 Pass the Hash.
Detection logic and log sources
ATT&CK v20 maps one detection strategy to T1557 and one to each sub-technique. The table distils the analytics into events to collect and rules to write.
| Scope | Log sources (ATT&CK v20 analytics) | Rule logic |
|---|---|---|
| LLMNR, NBT-NS and SMB relay | Network sensor traffic on UDP 5355 and UDP 137; Windows Security Event ID 4697 (service installed); registry change to HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast | Responses to LLMNR or NBT-NS queries from hosts that are not DNS servers; SMB authentication to a host shortly after it answered a poisoned query; policy re-enabling multicast name resolution |
| ARP cache poisoning | Network flow and packet capture, auditd changes to ARP entries, macOS unified log, switch DAI logs | Several IP addresses resolving to one MAC; gratuitous ARP replies for the gateway from a non-gateway port; ARP table entries inconsistent with DHCP leases |
| DHCP spoofing | Windows System log Event IDs 1341, 1342, 1020 and 1063 (DHCP server warnings), Linux syslog dhclient messages, packet capture | More than one DHCP OFFER for a DISCOVER; leases assigning DNS or gateway values outside the approved list |
| Evil twin | Wireless controller association logs, WIDS alerts, network device syslog | Same SSID advertised by an unknown BSSID or with a weaker security type; probe responses from unauthorised APs; clients redirected to non-standard portals |
| General AiTM and configuration tampering | Windows Security Event IDs 4656, 4663, 4670 on network configuration keys; Sysmon Event IDs 3 and 22; edits to /etc/hosts or /etc/resolv.conf; macOS configuration profile installs; network device config change logs | Local DNS, proxy or trusted certificate changes followed by unusual traffic or authentication; unexpected route changes or duplicate gateway advertisements; TLS downgrade or inconsistent DNS answers |
Authentication signals that reveal relay
- NTLM logons from an unexpected source: Security Event ID 4624 with NTLM authentication where the workstation name and source IP do not match, or a computer account authenticating from a host that is not itself.
- NTLM auditing: enable the NTLM operational log and audit policies before enforcement so you can see which services still accept NTLM. See the NTLM Deprecation and Elimination Guide.
- Directory changes after relay: new resource-based constrained delegation settings, new certificate enrolments or new computer objects created shortly after an NTLM logon from an unusual source.
Prevention controls mapped to ATT&CK mitigations
| ATT&CK mitigation | Concrete control | Sub-technique |
|---|---|---|
| M1042 Disable or Remove Feature or Program | Group Policy "Turn off multicast name resolution" (disables LLMNR); disable NetBIOS over TCP/IP through DHCP option or adapter settings; remove WPAD where unused | .001, .002 |
| M1037 Filter Network Traffic | Host firewall rules blocking inbound UDP 5355 and 137; DHCP snooping; Dynamic ARP Inspection | .001, .002, .003 |
| M1041 Encrypt Sensitive Information | TLS with certificate validation everywhere, SMB encryption for sensitive shares, IPsec where legacy protocols remain | All |
| M1030 Network Segmentation | Small broadcast domains, isolate servers and admin workstations from user VLANs | .001, .002 |
| M1035 Limit Access to Resource Over Network | Restrict which hosts can reach SMB, LDAP and management interfaces | .002 |
| M1031 Network Intrusion Prevention | NIDS signatures for poisoning tools, rogue DHCP and ARP anomalies; wireless IPS | All |
| M1017 User Training | Teach users to reject unexpected certificate warnings and captive portals asking for corporate credentials | .002, .004 |
ATT&CK mitigations do not name every protocol hardening setting that stops relay. Add SMB signing required on clients and servers (see the SMB Signing Guide), LDAP signing and LDAP channel binding on domain controllers, Extended Protection for Authentication on IIS and AD CS web enrolment, and a programme to retire NTLM. The NTLM Relay Guide covers these in depth.
Where identity fits
- Computer and service accounts: coerced authentication from a domain controller or server relayed to AD CS or LDAP can yield certificates or delegation rights for that machine identity. Inventory which services run as privileged accounts and remove NTLM paths to them. See the Service Account Security Guide.
- Kerberos over NTLM: Kerberos is not relayable in the same way, so increasing Kerberos use reduces T1557.001 value. See the Kerberos Security Guide.
- Mutual authentication for workloads: mTLS between services makes an on-path attacker visible because it cannot present a valid certificate. See the mTLS Guide.
- Wi-Fi credentials: PEAP with password-based inner methods and no server certificate validation hands credentials to an evil twin. EAP-TLS with device certificates does not. See the 802.1X and EAP-TLS Enterprise Wi-Fi Guide.
How to implement
- Measure exposure: run a passive network sensor for a week to count LLMNR and NBT-NS queries and responders, and enable NTLM auditing on domain controllers and key servers.
- Disable LLMNR and NBT-NS in rings: apply the Group Policy setting and NetBIOS change to a pilot OU, check for broken name lookups (usually missing DNS records), fix DNS, then expand. Roll back by unlinking the GPO.
- Require SMB signing: audit first, then enforce on servers, then clients; legacy NAS and printers are the usual breakers.
- Enforce LDAP signing and channel binding: monitor domain controller events that report unsigned and non-binding binds, remediate clients, then enforce.
- Switch controls: enable DHCP snooping with only uplinks and authorised DHCP servers trusted, then Dynamic ARP Inspection using the snooping binding table; start in monitor mode where the platform supports it.
- Wireless: move corporate SSIDs to EAP-TLS, enforce server certificate validation through device management and enable rogue AP detection.
- Deploy detections: poisoned response detection, multiple DHCP OFFERs, ARP anomalies, NTLM source mismatch and configuration tampering rules, tuned in alert-only mode first.
Decision guidance
- Disable versus monitor LLMNR: disabling is cheap and rarely breaks anything that DNS cannot fix; monitoring alone leaves the path open.
- SMB signing performance: modern hardware absorbs the cost; reserve exceptions for documented legacy devices on isolated segments.
- Small organisations: disable LLMNR and NBT-NS, require SMB signing, use WPA3-Enterprise or WPA2-Enterprise with certificate validation, and keep broadcast domains small.
- Large organisations: fund the NTLM retirement programme, deploy DHCP snooping and DAI across access switches and run wireless IDS.
Detection and measurement
- LLMNR and NBT-NS responders: count of hosts answering multicast or broadcast name queries; target zero.
- SMB signing coverage: percentage of servers and clients that require signing.
- NTLM share of authentications: trend of NTLM versus Kerberos logons on domain controllers.
- Switch coverage: percentage of access ports with DHCP snooping and DAI enabled.
- Rogue AP and rogue DHCP detections: number per month and time to locate and remove.
Common failure patterns
- Disabling LLMNR but not NBT-NS: poisoning tools fall back to NetBIOS name service.
- Signing enabled but not required: SMB or LDAP signing negotiated only if both sides ask, which a relay attacker will not.
- Trusting every switch port: DHCP snooping enabled with user ports marked trusted, so a rogue server still works.
- PEAP without certificate validation: clients accept any RADIUS certificate and send credentials to an evil twin.
- Ignoring machine accounts: relay detections that alert on user accounts only, missing coerced computer account authentication.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1557, T1557.001 to T1557.004; related T1040, T1187, T1550.002, T1565.002 | Technique and chaining |
| NIST SP 800-53 Rev. 5 | SC-8 Transmission Confidentiality and Integrity, SC-23 Session Authenticity, IA-3 Device Identification and Authentication, AC-18 Wireless Access, SI-4(14) Wireless Intrusion Detection | In-transit protection and network authentication |
| NIST CSF 2.0 | PR.DS-02, PR.IR-01, DE.CM-01 | Data in transit, network protection, monitoring |
| CIS Controls v8.1 | Control 12 Network Infrastructure Management; Control 13 Network Monitoring and Defense | Network hardening and detection |
| ISO/IEC 27001:2022 Annex A | A.8.20 Networks security; A.8.21 Security of network services; A.8.22 Segregation of networks | Network controls |
Practitioner checklist
- LLMNR disabled by Group Policy and NetBIOS over TCP/IP disabled on all Windows hosts.
- SMB signing required on servers and clients, with documented exceptions only.
- LDAP signing and channel binding enforced on domain controllers.
- Extended Protection for Authentication on IIS and AD CS web enrolment.
- DHCP snooping and Dynamic ARP Inspection on access switches.
- Corporate Wi-Fi on EAP-TLS with enforced server certificate validation.
- Detections for poisoned responses, rogue DHCP, ARP anomalies and NTLM source mismatch.
- NTLM auditing on and a retirement plan with owners.
Standards and references
- MITRE ATT&CK: Adversary-in-the-Middle (T1557)
- MITRE ATT&CK: Name Resolution Poisoning and SMB Relay (T1557.001)
- MITRE ATT&CK: ARP Cache Poisoning (T1557.002)
- MITRE ATT&CK: DHCP Spoofing (T1557.003)
- MITRE ATT&CK: Evil Twin (T1557.004)
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: NTLM Relay Guide, SMB Protocol Security and Signing Guide, DHCP Security Guide, Wi-Fi Security Guide, AiTM Phishing Guide.