SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Network and infrastructure attacks

SSL stripping

On-path proxy downgrades HTTPS to HTTP

categoryNetwork and infrastructure attacksseverityHighdetectabilityHighlabnot yet measured

Example: sslstrip; mitigated by HSTS

Classification

29 values: 15 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Network attacks
Reach (CVSS)	Adjacent
Attack complexity	Low
Privileges required	None
User interaction	Passive
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Legacy / declining

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	LinuxmacOSNetwork DevicesWindows
Environment	On-premises
Target asset class	HumanWeb app / API
Kill-chain phase (tactic)	CollectionCredential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentFile ModificationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowWindows Registry Key Modification

Detection & response

Mitigated by 17

M1017 attack-mitigation
M1030 attack-mitigation
M1031 attack-mitigation
M1035 attack-mitigation
M1037 attack-mitigation
M1041 attack-mitigation
M1042 attack-mitigation
D3-APCA d3fend
D3-CAA d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RTSD d3fend
D3-UGLPA d3fend

Detected by 22

DET0296 attack-detection-strategy
0ed99dda-6a35-11ef-8c99-0242ac120002 sigma
16f5d8ca-44bd-47c8-acbe-6fc95a16c12f sigma
2074e137-1b73-4e2d-88ba-5a3407dbdce0 sigma
3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09 sigma
4096842a-8f9f-4d36-92b4-d0b2a62f9b2a sigma
4627c6ae-6899-46e2-aa0c-6ebcb1becd19 sigma
50e606bf-04ce-4ca7-9d54-3449494bbd4b sigma
5588576c-5898-4fac-bcdd-7475a60e8f43 sigma
5589ab4f-a767-433c-961d-c91f3f704db1 sigma
56fa3cd6-f8d6-4520-a8c7-607292971886 sigma
679085d5-f427-4484-9f58-1dc30a7c426d sigma
a557ffe6-ac54-43d2-ae69-158027082350 sigma
a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43 sigma
b07e58cf-cacc-4135-8473-ccb2eba63dd2 sigma
bb0e87ce-c89f-4857-84fa-095e4483e9cb sigma
bc2e25ed-b92b-4daa-b074-b502bdd1982b sigma
c2c76b77-32be-4d1f-82c9-7e544bdfe0eb sigma
cd8c163e-a19b-402e-bdd5-419ff5859f12 sigma
d22df9cd-2aee-4089-93c7-9dc4eae77f2c sigma
e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c sigma
ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4 sigma

Tested by 1

deecd55f-afe0-4a62-9fba-4d1ba2deb321 atomic

Attack relationships

Child: ARP spoofing / poisoning
Child: DHCP starvation
Child: Evil twin AP
Child: LLMNR / NBT-NS / mDNS poisoning
Child: NTLM relay / name-resolution poisoning
Child: Rogue DHCP / DHCP spoofing
Child: SMB / NTLM relay

Framework references

Primary source: https://www.cloudflare.com/learning/security/threats/man-in-the-middle-attack/
attack: T1557 (primary)
capec: CAPEC-620

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 163 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1557, capec:CAPEC-620 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 9 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)