CmdID

CmdID / Techniques

T1557 Adversary-in-the-Middle

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for… MITRE ATT&CK

2 Sigma rules T1557 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1557.001Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay

Sigma rules tagged with it

process creation, the highest levels first
highSuspicious Child Process of Notepad++ Updater - GUP.ExeSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To incorporate changes required by the analysis process on the SecContoso.inf file, and then to direct the output to the existing file, SecAnalysisContosoFY11, without prompting, type on the page for secedit configure

secedit /configure /db C:\Security\FY11\SecDbContoso.sdb /cfg SecContoso.inf /overwrite /log C:\Security\FY11\SecAnalysisContosoFY11.xml /quietIdentify

To export the security database and the domain security policies to an inf file, and then import that file to a different database in order to replicate the security policy settings on another computer, type on the page for secedit export

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

To export the security database and the domain security policies to an .inf file, and then to import that file to a different database to replicate the policy settings on another computer, type on the page for secedit import

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg NetworkShare\Policies\SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

An example is here when CmdID’s reading of it names T1557: a Sigma rule it trips is tagged with it, or its abuse is documented as it.