What is Man-in-the-Middle Attack?
A man-in-the-middle (MITM) attack is one where the attacker secretly places themselves between two parties who believe they are talking directly, so they can read, relay or alter the traffic. On a local network that usually means ARP or DHCP spoofing; across the internet it means rogue Wi-Fi, DNS tampering or a reverse proxy in front of a login page.
Definition
- Man-in-the-Middle Attack
- A man-in-the-middle (MITM) attack is one where the attacker secretly places themselves between two parties who believe they are talking directly, so they can read, relay or alter the traffic. On a local network that usually means ARP or DHCP spoofing; across the internet it means rogue Wi-Fi, DNS tampering or a reverse proxy in front of a login page.
How Man-in-the-Middle Attack Works
NIST defines it as an attack in which the attacker is positioned between two communicating parties to intercept and/or alter the data traveling between them. MITRE ATT&CK calls the technique Adversary-in-the-Middle (T1557) and splits it by how the attacker gets into the path:
- LLMNR/NBT-NS poisoning and SMB relay,
- ARP cache poisoning,
- DHCP spoofing
- and evil twin Wi-Fi access points.
ARP cache poisoning (T1557.002) is the classic local version. ARP resolves IPv4 addresses to MAC addresses and has no authentication, so an attacker on the same segment can answer ARP requests, or send unsolicited replies, claiming that the gateway's IP address belongs to their own MAC address. Victims then send their traffic to the attacker, who forwards it so nothing appears broken. From that seat the attacker can sniff unencrypted protocols, tamper with transmitted data and capture authentication attempts for relay. An evil twin does the same job over Wi-Fi by broadcasting a trusted network name with a stronger signal.
On the internet the middle is usually a reverse proxy. Phishing kits that proxy the real login page relay the password and the MFA prompt and keep the session cookie that comes back, so the attacker inherits an authenticated session. Encryption with proper validation is the common defense across all of these:
- TLS with certificate checks that users and applications cannot click through,
- HSTS so browsers refuse to downgrade,
- SMB and LDAP signing on Windows networks,
- and phishing-resistant MFA bound to the real site's origin, which a proxy on another domain cannot satisfy.
Man-in-the-Middle Attack in SOC Operations
MITM detection lives mostly in network and identity telemetry. On a LAN, look for one MAC address claiming several IP addresses, above all the default gateway, bursts of gratuitous ARP, and switch events from dynamic ARP inspection or DHCP snooping where those features are on. On Windows networks, LLMNR or NBT-NS responses coming from a workstation, and NTLM authentications relayed from a host the user never touched, point to poisoning and relay tooling. In identity logs, a session cookie reused from a different IP, ASN or device minutes after the user signed in suggests a proxy sat in the path. Confirm by comparing the ARP table on an affected host with the gateway's real MAC, and treat credentials that crossed the poisoned path as exposed.
Practice Man-in-the-Middle Attack in a Real SOC
SOCSimulator provides hands-on training with realistic SIEM, XDR, and Firewall interfaces. Build real analyst skills investigating man-in-the-middle attack scenarios with zero consequences, free.
Frequently Asked Questions
- What is the new name for man-in-the-middle attack?
- Adversary-in-the-middle, often shortened to AiTM. MITRE ATT&CK uses that name for technique T1557, and you will also see machine-in-the-middle and on-path attack. The mechanics do not change with the name: the attacker sits in the communication path and can read or modify what passes through.
- How to detect a man-in-the-middle attack?
- Look for the attacker's footprint in the path: two IP addresses sharing one MAC (especially the gateway's), certificate warnings or certificates from an unexpected issuer, LLMNR or NBT-NS replies from workstations, and sessions whose cookies get reused from a different IP or device than the one that signed in. Switch features like dynamic ARP inspection flag the LAN variants automatically.
- How do you get rid of a man-in-the-middle attack?
- Remove the attacker from the path, then assume whatever passed through it is compromised. Unplug the rogue device or access point, clear poisoned ARP caches, disable LLMNR and NBT-NS if they were abused, and reset credentials and revoke sessions for the users whose traffic crossed it. Longer term, enforce SMB signing, HSTS and phishing-resistant MFA so a future interception yields nothing usable.
Sources
Related Terms
NDR (network detection and response) is security software that analyzes network traffic, as raw pack...
MFA (multi-factor authentication) is a sign-in check that asks for two or more different kinds of pr...
Phishing is a social engineering attack delivered via email, SMS, voice calls, or other channels tha...
Lateral movement is the attack phase where adversaries expand access from an initial foothold to add...
Zero Trust is a security architecture philosophy based on "never trust, always verify," requiring co...
Credential stuffing is an automated attack in which an adversary takes large lists of username-and-p...