中间人攻击

Sub-techniques (4)

ID	Name
T1557.001	HTTPS降级与协议模拟
T1557.002	合法证书滥用中间人
T1557.003	无线接入点伪装劫持
T1557.004	DNS透明化流量重定向

中间人攻击指攻击者通过协议操纵或网络拓扑欺骗，在通信双方之间建立隐蔽的代理节点，进而实施数据窃取、会话劫持或流量篡改。传统防御手段依赖证书验证、协议完整性检查及异常流量分析，可通过部署DNSSEC、HSTS强制加密、无线网络指纹认证等措施进行缓解。监控重点包括ARP表异常变更、DNS解析异常及SSL/TLS协议降级事件。

为规避传统检测机制，现代中间人攻击技术向协议合规化、凭证合法化、交互透明化方向演进。攻击者通过滥用数字证书体系、深度模拟协议栈行为、动态适配网络环境基线等手段，使恶意节点具备与合法服务等同的协议特征与信任等级，显著提升攻击链路的隐蔽性与持续性。

中间人攻击匿迹技术的核心在于构建"协议级拟态"与"信任链渗透"双重能力。HTTPS降级攻击通过协议版本操控与交互场景仿真，在维持加密信道表象下实施降级突破；合法证书滥用技术利用信任体系缺陷，使攻击节点获得权威CA背书；无线劫持依托物理信号伪装与协议状态机兼容，实现透明化接入控制；DNS重定向则通过精细化流量操控维持解析服务正常特征。这些技术的共性在于突破传统网络层对抗模式，从密码学信任机制、协议规范实现等底层维度重构攻击链路，使中间人节点在协议合规性、交互时序、加密强度等维度与合法服务高度一致，导致传统基于特征匹配或异常阈值的检测体系失效。

匿迹技术的发展迫使防御方构建多维度信任验证体系，需结合证书透明度日志分析、无线环境射频指纹认证、DNS解析链路完整性验证等新型检测手段，同时强化终端侧证书钉扎、协议严格模式配置等主动防护策略，实现对高级中间人攻击的动态防御。

ID: T1557

Sub-techniques: T1557.001, T1557.002, T1557.003, T1557.004

ⓘ

Tactics: 凭据获取, 信息收集

ⓘ

Platforms: Linux, Network, Windows, macOS

Contributors: Daniil Yugoslavskiy, @yugoslavskiy, Atomic Threat Coverage project; Mayuresh Dani, Qualys; NEC

Version: 2.4

Created: 11 February 2020

Last Modified: 18 April 2024

匿迹效应

效应类型	是否存在
特征伪装	✅
行为透明	✅
数据遮蔽	✅
时空释痕	❌

特征伪装

攻击者通过协议栈深度模拟与合法凭证滥用，使中间人节点在协议交互特征、加密套件支持、证书链验证等维度与目标服务完全一致。例如使用合法数字证书构建恶意代理，或精确复制无线热点的物理层参数，使得防御方无法通过常规协议分析识别流量异常。

行为透明

部分技术（如HTTPS降级）利用协议设计缺陷或零日漏洞实施攻击，传统基于已知特征库的检测系统难以有效识别。攻击者通过未公开的协议状态机操控方法，在无需触发显式告警的条件下完成会话劫持。

数据遮蔽

在证书滥用攻击中，攻击者使用标准加密协议（如TLS 1.3）保护恶意流量，使中间人节点与客户端、服务端之间的通信内容均被加密，防御方无法通过流量解密直接获取攻击证据。无线劫持场景下，攻击者亦可部署加密隧道回传窃取数据。

Procedure Examples

ID	Name	Description
S0281	Dok	Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.^[1]^[2]
G0094	Kimsuky	Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.^[3]
S1131	NPPSPY	NPPSPY opens a new network listener for the `mpnotify.exe` process that is typically contacted by the Winlogon process in Windows. A new, alternative RPC channel is set up with a malicious DLL recording plaintext credentials entered into Winlogon, effectively intercepting and redirecting the logon information.^[4]

Mitigations

ID	Mitigation	Description
M1042	Disable or Remove Feature or Program	Disable legacy network protocols that may be used to intercept network traffic if applicable, especially those that are not needed within an environment.
M1041	Encrypt Sensitive Information	Ensure that all wired and/or wireless traffic is encrypted appropriately. Use best practices for authentication protocols, such as Kerberos, and ensure web traffic that may contain credentials is protected by SSL/TLS.
M1037	Filter Network Traffic	Use network appliances and host-based security software to block network traffic that is not necessary within the environment, such as legacy protocols that may be leveraged for AiTM conditions.
M1035	Limit Access to Resource Over Network	Limit access to network infrastructure and resources that can be used to reshape traffic or otherwise produce AiTM conditions.
M1031	Network Intrusion Prevention	Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.
M1030	Network Segmentation	Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.
M1017	User Training	Train users to be suspicious about certificate errors. Adversaries may use their own certificates in an attempt to intercept HTTPS traffic. Certificate errors may arise when the application’s certificate does not match the one expected by the host.

Detection

ID	Data Source	Data Component	Detects
DS0015	Application Log	Application Log Content	Monitor application logs for changes to settings and other events associated with network protocols and other services commonly abused for AiTM.^[5]
DS0029	Network Traffic	Network Traffic Content	Monitor network traffic for anomalies associated with known AiTM behavior.
		Network Traffic Flow	Monitor for network traffic originating from unknown/unexpected hardware devices. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware.
DS0019	Service	Service Creation	Monitor for newly constructed services/daemons through Windows event logs for event IDs 4697 and 7045. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as remote logins or process creation events.
DS0024	Windows Registry	Windows Registry Key Modification	Monitor HKLM\Software\Policies\Microsoft\Windows NT\DNSClient for changes to the "EnableMulticast" DWORD value. A value of "0" indicates LLMNR is disabled.