<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-man-in-the-middle-attacks
description: >-
  Detect and prevent MITM attacks including ARP poisoning, SSL stripping, rogue access
  points, DNS spoofing, and LLMNR/NBT-NS poisoning using network monitoring, certificate
  pinning validation, and protocol integrity checks.
domain: cybersecurity
subdomain: network-security
tags:
  - mitm
  - arp-poisoning
  - ssl-stripping
  - dns-spoofing
  - zeek
  - suricata
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.001", "T1557.002", "T1557.003"]
  nist-csf: ["DE.CM-1", "DE.AE-2", "PR.DS-2"]
  uuid: a1b2c3d4-1005-4a00-b005-f00d00000005
---

# Detecting Man-in-the-Middle Attacks

## Overview

MITM attacks intercept communications between two parties to eavesdrop, modify, or inject
data. Detection requires monitoring for ARP anomalies, certificate changes, protocol
downgrade attempts, and rogue network services. This skill covers detection of ARP cache
poisoning, SSL/TLS stripping, LLMNR/NBT-NS poisoning, DHCP spoofing, and rogue AP
identification.

Mode: `[MODE: BLUE]` for detection; `[MODE: RED]` for testing/validation.

## Prerequisites

| Requirement | Details |
|---|---|
| Zeek 6.0+ for protocol analysis | Required |
| Suricata 7.0+ with ARP and TLS inspection | Required |
| arpwatch or arpalert for ARP monitoring | Required |
| nmap for network discovery | Required |
| Wireshark/tshark for packet analysis | Required |

## Key Concepts

### ARP Poisoning Detection

```bash
# Monitor ARP table for changes
arpwatch -i eth0 -f /var/lib/arpwatch/arp.dat

# Detect duplicate IP-MAC mappings
ip neigh show | awk '{print $1}' | sort | uniq -d

# Suricata ARP anomaly detection
# (requires af-packet or netmap capture)
```

### Suricata MITM Detection Rules

```
# Detect LLMNR poisoning (Responder)
alert udp any any -> 224.0.0.252 5355 ( \
  msg:"MITM - LLMNR query detected on network"; \
  content:"|00 00|"; offset:2; depth:2; \
  threshold:type both, track by_src, count 20, seconds 60; \
  sid:3001030; rev:1; \
  metadata:mitre_attack_technique T1557.001;)

# Detect NBT-NS poisoning
alert udp any 137 -> any any ( \
  msg:"MITM - NBT-NS response from non-DNS server"; \
  content:"|85|"; offset:2; depth:1; \
  threshold:type limit, track by_src, count 1, seconds 300; \
  sid:3001031; rev:1;)

# Detect SSL stripping — HTTP on typically HTTPS port
alert http any any -> any 443 ( \
  msg:"MITM - HTTP traffic on port 443 (SSL strip suspected)"; \
  flow:established,to_server; \
  http.method; content:"GET"; \
  sid:3001032; rev:1;)

# Detect TLS certificate change for known host
alert tls any any -> $EXTERNAL_NET any ( \
  msg:"MITM - TLS certificate fingerprint mismatch"; \
  tls.cert_fingerprint; \
  sid:3001033; rev:1;)
```

### Zeek MITM Detection Scripts

```zeek
# arp-mitm-detect.zeek — detect ARP spoofing
@load base/protocols/conn

module MITMDetect;

export {
    redef enum Notice::Type += {
        ARP_Duplicate_IP,
        TLS_Cert_Changed,
    };
}

global ip_mac_map: table[addr] of string = {};

event arp_reply(mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string) {
    if ( SPA in ip_mac_map ) {
        if ( ip_mac_map[SPA] != SHA ) {
            NOTICE([$note=ARP_Duplicate_IP,
                    $msg=fmt("ARP spoof: %s was %s now %s", SPA, ip_mac_map[SPA], SHA)]);
        }
    }
    ip_mac_map[SPA] = SHA;
}
```

### Testing with Common Tools

```bash
# Test ARP poisoning detection (lab only)
# Using arpspoof from dsniff
arpspoof -i eth0 -t 10.0.0.1 10.0.0.254

# Test LLMNR/NBT-NS poisoning detection
# Responder generates detectable traffic
responder -I eth0 -A  # Analyze mode only

# Verify with packet capture
tshark -i eth0 -f "arp" -Y "arp.duplicate-address-detected"
```

## Workflow

### Step 1: Baseline Network Identity

Map MAC-to-IP bindings for critical infrastructure. Deploy arpwatch.

### Step 2: Deploy Detection Rules

Load Suricata and Zeek scripts for ARP, LLMNR, and TLS anomalies.

### Step 3: Monitor Certificate Integrity

Track TLS certificate fingerprints for critical services.

### Step 4: Validate Detection

```bash
# Check Suricata alerts
cat /var/log/suricata/eve.json | \
  jq 'select(.alert.signature | contains("MITM"))'

# Review Zeek notices
cat notice.log | zeek-cut note msg sub
```

## Detection

```yaml
title: Man In The Middle Attacks Detection
id: 9b1d1dec-5ff6-4f63-8073-3a0a0f71ad03
status: experimental
description: Detects suspicious activity related to detecting man in the middle attacks techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1557.001
  - attack.t1557.002
  - attack.t1557.003
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Man In The Middle Attacks Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.001, T1557.002, T1557.003 |

## Verification

- [ ] ARP spoofing detected within 30 seconds
- [ ] LLMNR/NBT-NS poisoning alerts fire on Responder traffic
- [ ] SSL stripping attempts detected
- [ ] TLS certificate changes generate alerts
- [ ] False positive rate acceptable for production
- [ ] Alerts delivered to SIEM with actionable context

## References

- [Zeek ARP Analysis](https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_ARP.events.bif.zeek.html)
- MITRE ATT&CK T1557 — Adversary-in-the-Middle
- SANS SEC504: Hacker Tools, Techniques, and Incident Handling
- CIS Controls v8 — Control 13: Network Monitoring and Defense
