Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Adversaries may attempt to position themselves between two or more networked devices using an adversary - in -the - middle(AiTM) technique to support follow - on behaviors such as Network Sniffing or Transmitted Data Manipulation.By abusing features of common networking protocols that can determine the flow of network traffic(e.g.ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.