T0830 Adversary-in-the-Middle
ICSAdversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks. This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a AiTM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy. An AiTM attack may allow an adversary to perform the following attacks: Block Reporting Message, Spoof Reporting Message, Modify Parameter, Unauthorized Command Message
platforms
Platforms this applies to.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
software (1)
Malware and tools associated with this.
targets assets (18)
ICS/OT assets this targets.
campaigns (1)
Campaigns that use this.
source
Where this definition is published.