Adversary-in-the-Middle Network Poisoning and Credential Relay Activity

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•4•0•13

This rule detects activities associated with AiTM (Adversary-in-the-Middle) attacks, specifically targeting network-based credential interception. It monitors for the execution of well-known poisoning tools (e.g., Responder), ARP spoofing utilities (e.g., ettercap, arpspoof), the creation of suspicious network listeners on protocols used for NBT-NS/LLMNR poisoning, and the execution of credential relaying tools like Impacket.