1200KM / detection
T1557 Adversary-in-the-Middle — Detection Rules
Detection workspace for T1557 Adversary-in-the-Middle: 9 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Cisco BGP Authentication Failures · test · low · {"product":"cisco","service":"bgp","definition":"Requirements: cisco bgp logs need to be enabled and ingested"}
- Cisco LDP Authentication Failures · test · low · {"product":"cisco","service":"ldp","definition":"Requirements: cisco ldp logs need to be enabled and ingested"}
- Huawei BGP Authentication Failures · test · low · {"product":"huawei","service":"bgp","definition":"Requirements: huawei bgp logs need to be enabled and ingested"}
- Juniper BGP Missing MD5 · test · low · {"product":"juniper","service":"bgp","definition":"Requirements: juniper bgp logs need to be enabled and ingested"}
- ISATAP Router Address Was Set · experimental · medium · {"product":"windows","service":"system"}
- Notepad++ Updater DNS Query to Uncommon Domains · experimental · medium · {"category":"dns_query","product":"windows"}
- Uncommon File Created by Notepad++ Updater Gup.EXE · experimental · high · {"category":"file_event","product":"windows"}
- Suspicious Child Process of Notepad++ Updater - GUP.Exe · experimental · high · {"category":"process_creation","product":"windows"}
- Potential Suspicious Activity Using SeCEdit · test · medium · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0296 Detect Adversary-in-the-Middle via Network and Configuration Anomalies
AN0823 Analytic 0823
Detects suspicious DNS/ARP poisoning attempts, unauthorized modifications to registry/network configuration, or abnormal TLS downgrade activity. Correlates changes in system configuration with subsequent unusual network flows or authentication events.
AN0824 Analytic 0824
Detects unauthorized edits to /etc/hosts, /etc/resolv.conf, or suspicious ARP broadcasts. Correlates file modifications with subsequent unexpected network sessions or service creation.
AN0825 Analytic 0825
Detects unauthorized edits to system configuration profiles, unexpected certificate trust changes, or abnormal ARP/DNS patterns indicative of interception.
AN0826 Analytic 0826
Detects unauthorized firmware or configuration changes enabling adversary-in-the-middle positioning (e.g., route injection, DNS spoofing, SSL downgrade). Behavioral analytics focus on sudden changes to routing tables or image file integrity failures.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.