value: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](T1040) or [Transmitted Data Manipulation](T1565.002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)
  
  Adversaries may leverage the AiTM position to attempt to modify traffic, such as in [Transmitted Data Manipulation](T1565.002). Adversaries can also stop traffic from flowing to the appropriate destination, causing denial of service.
name: Adversary-in-the-Middle