Which SIEM platforms have a T1557 detection rule?

df00tech provides T1557 (Adversary-in-the-Middle) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Adversary-in-the-Middle (T1557)?

Detecting Adversary-in-the-Middle requires the following data sources: Process: Process Creation, Command: Command Execution, Windows Registry: Registry Key Modification, Microsoft Defender for Endpoint.

What severity and confidence is the T1557 detection?

The T1557 detection is rated high severity with medium confidence.

What are common false positives for T1557?

Common false positives for T1557 include: Network engineers using arp -s for legitimate static ARP entry management on servers or network appliances; Security teams running authorized penetration tests or red team exercises using Responder, Bettercap, or Ettercap in approved lab segments; IT administrators reconfiguring DNS server settings via netsh or Set-DnsClientServerAddress during planned network migrations or failover procedures.

T1557 Elastic Security · Elastic

Detect Adversary-in-the-Middle in Elastic Security

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing (T1040), Transmitted Data Manipulation (T1565.002), or replay attacks. By abusing features of common networking protocols (ARP, DNS, LLMNR, DHCP), adversaries force devices to communicate through an adversary-controlled system to harvest credentials, session tokens, and sensitive data. Sub-techniques include LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001), ARP Cache Poisoning (T1557.002), DHCP Spoofing (T1557.003), and Evil Twin wireless attacks (T1557.004). Common attack frameworks include Responder, Bettercap, Ettercap, ntlmrelayx, mitmproxy, dnschef, and EvilGinx2. Threat groups including Kimsuky, Sea Turtle, and Mustang Panda have leveraged AiTM positioning for large-scale credential theft, session hijacking, and DNS record manipulation at service providers.

MITRE ATT&CK

Tactic: Credential Access Collection
Technique: T1557 Adversary-in-the-Middle
Canonical reference: https://attack.mitre.org/techniques/T1557/

Elastic Detection Query

Elastic Security (Elastic)

eql

sequence by host.name with maxspan=5m
  [process where event.type == "start" and (
    process.name : ("responder.exe","bettercap","bettercap.exe","ettercap","ettercap.exe","mitmproxy","mitmdump","mitmweb","dnschef","sslstrip","evilginx","evilginx2","mitm6","mitm6.py") or
    process.args : ("responder","bettercap","ettercap","mitmproxy","ntlmrelayx","smbrelayx","multirelay","dnschef","sslstrip","mitm6","evilginx","arpspoof","impacket-ntlmrelayx") or
    (process.name : ("python.exe","python3","python3.exe") and process.args : ("ntlmrelayx","smbrelayx","responder","mitm6","dnschef","evilginx")) or
    (process.name : "arp.exe" and process.args : "-s") or
    (process.name : "netsh.exe" and process.args : ("interface","dns","set")) or
    (process.name : "powershell.exe" and process.args : "Set-DnsClientServerAddress")
  )]
any where true

OR

process where event.type == "start" and (
  process.name : ("responder.exe","bettercap","bettercap.exe","ettercap","ettercap.exe","mitmproxy","mitmdump","mitmweb","dnschef","sslstrip","evilginx","evilginx2","mitm6") or
  process.command_line : ("*responder*","*ntlmrelayx*","*smbrelayx*","*multirelay*","*bettercap*","*ettercap*","*arpspoof*","*mitmproxy*","*mitmdump*","*sslstrip*","*dnschef*","*mitm6*","*evilginx*","*impacket-ntlmrelayx*","*Set-DnsClientServerAddress*") or
  (process.name : "arp.exe" and process.command_line : "* -s *") or
  (process.name : "netsh.exe" and process.command_line : ("*interface*dns*set*","*int*ip*set*dns*"))
)
| eval detection_category = case(
    process.command_line like "*responder*" or process.command_line like "*ntlmrelayx*" or process.command_line like "*smbrelayx*" or process.command_line like "*multirelay*", "LLMNR_NBT_NS_Relay",
    process.command_line like "*bettercap*" or process.command_line like "*ettercap*" or process.command_line like "*arpspoof*", "ARP_Poisoning",
    process.command_line like "*mitmproxy*" or process.command_line like "*mitmdump*" or process.command_line like "*sslstrip*", "SSL_Interception",
    process.command_line like "*dnschef*" or process.command_line like "*mitm6*" or process.command_line like "*evilginx*", "DNS_Spoofing",
    process.command_line like "*Set-DnsClientServerAddress*" or (process.name == "netsh.exe" and process.command_line like "*dns*"), "DNS_Config_Modification",
    "AiTM_Tool_Other"
  )

high severity high confidence

Detects execution of known Adversary-in-the-Middle (AiTM) tooling including Responder, Bettercap, Ettercap, mitmproxy, ntlmrelayx, dnschef, mitm6, and EvilGinx2. Also detects DNS server configuration changes via PowerShell or netsh, and static ARP cache manipulation. Covers LLMNR/NBT-NS poisoning, ARP cache poisoning, SSL interception, and DNS spoofing sub-techniques.

Data Sources

Elastic Endpoint SecurityElastic Agent with Windows integrationSysmon via Elastic Agent

Required Tables

logs-endpoint.events.process-*logs-windows.sysmon_operational-*winlogbeat-*

False Positives & Tuning

Network engineers using legitimate ARP utilities for network diagnostics
Security teams running authorized penetration tests with Responder or Bettercap in lab environments
DNS administrators using netsh or PowerShell cmdlets to reconfigure DNS server addresses on workstations
Python-based network tools that share naming conventions with AiTM frameworks (e.g., custom mitmproxy usage for API testing)

Download portable Sigma rule (.yml)

Other platforms for T1557

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1ARP Static Entry Manipulation (Windows)
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\arp.exe, CommandLine='arp -s 192.168.100.254 00-AA-BB-CC-DD-EE'. Security Event ID 4688 (if command-line auditing is enabled). No network events expected as this is a local table modification.
Test 2DNS Server Change via netsh (Windows)
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\netsh.exe, CommandLine containing 'interface ip set dns'. Sysmon Event ID 13: Registry value set under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID}\NameServer with new value '127.0.0.1'.
Test 3DNS Server Change via PowerShell (Windows)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Set-DnsClientServerAddress'. Sysmon Event ID 13: Registry modification at HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID}\NameServer. PowerShell ScriptBlock Log Event ID 4104 showing the Set-DnsClientServerAddress call.
Test 4ARP Poisoning Tool Execution — arpspoof (Linux)
Expected signal: Syslog or auditd process creation event for arpspoof. On systems with Sysmon for Linux (sysmonforlinux): Event ID 1 Process Create with Image path to arpspoof binary and CommandLine '-i lo -t 127.0.0.1 127.0.0.2'. Auditd syscall records for execve with the arpspoof arguments.
Test 5mitmproxy SSL Interception Tool Invocation (Linux/macOS)
Expected signal: Process creation event for mitmproxy binary (path varies by pip install location, typically ~/.local/bin/mitmproxy or /usr/local/bin/mitmproxy). Sysmon Event ID 1 (if Sysmon for Linux deployed) with Image containing 'mitmproxy' and CommandLine '--version'. Auditd EXECVE syscall record.

Last updated: 2026-04-13 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1557 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Adversary-in-the-Middle in Elastic Security

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1557

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (4)

Related Techniques

Same Tactic: Credential Access

Popular Detections

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1557

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (4)

Related Techniques

Same Tactic: Credential Access

Popular Detections

Get new detections in your inbox