Detecting Adversary-in-the-Middle (T1557) with Data Science

Charles Givre Posted on May 31 • Originally published at gtkcyber.com Detecting Adversary-in-the-Middle (T1557) with Data Science # cybersecurity # datascience # networking # python Adversary-in-the-Middle (T1557) is how attackers get between hosts to capture credentials and relay authentication. On internal networks the usual tools are Responder for LLMNR and NBT-NS poisoning, mitm6 for IPv6 DNS takeover, and classic ARP cache poisoning. None of these throw a malware signature. They abuse name resolution and Layer 2 mappings that are supposed to be trusted, so the durable signal is structural: one host suddenly claiming to be many others. That structure is exactly what a few lines of pandas and scapy surface well. Here is how to hunt the three most common T1557 variants. Where T1557 Shows Up Zeek dns.log captures LLMNR (UDP 5355) and NBT-NS (UDP 137) name resolution, including who answered A packet capture (or a SPAN/TAP feed) gives you ARP replies and DHCP offers that Zeek does not log by default DHCP server logs confirm which host is actually handing out leases You do not need a SIEM. Parse the Zeek log as a DataFrame and the PCAP with scapy. LLMNR and NBT-NS Poisoning (T1557.001) LLMNR and NBT-NS are fallback name resolution. A host that cannot resolve a name over DNS shouts the query to the local segment, and whoever answers wins. Normally almost nobody answers, because the name does not exist. Responder answers everything, claiming that every queried name lives at the attacker's IP. That is the tell. A legitimate host answers name queries for exactly one name: itself. A poisoner answers for dozens of distinct names. Load dns.log , keep the LLMNR and NBT-NS traffic, and count distinct names each answering IP claims: import pandas as pd def load_zeek ( path ): cols = None with open ( path ) as f : for line in f : if line . startswith ( " #fields " ): cols = line . strip (). split ( " \t " )[ 1 :] break return pd . read_csv ( path , sep = " \t " , comment =