Adversary-in-the-Middle
Technique · ATTACK:ics:T0830
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0830",
"title": "Adversary-in-the-Middle",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0830",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b",
"external_id": "T0830",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-10-13T17:48:43.971Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
"url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
},
{
"source_name": "Gabriel Sanchez October 2017",
"url": "https://www.sans.org/reading-room/whitepapers/ICS/man-in-the-middle-attack-modbus-tcp-illustrated-wireshark-38095"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:C0030 → uses → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03b4dae7-3b20-4ea9-9f7c-6c97582f98b7
Triton-EENews-2017ATTACK:ics:M0930 → mitigates → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35cf6922-d48f-42ea-b7f5-f0258892bd52
ATTACK:ics:M0810 → mitigates → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52855d5d-e835-470f-a675-751c2779c861
ATTACK:ics:M0813 → mitigates → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71e9230d-eec8-4ce1-bc96-9288bacc8b13
ATTACK:ics:M0814 → mitigates → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--808174b7-3ab0-45b5-963e-5c10dd749e3c
ATTACK:ics:M0931 → mitigates → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b13417ea-d8da-497f-818f-d2d90562039a
ATTACK:ics:M0947 → mitigates → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b47dbc50-fd8f-4e5b-bb3d-e93b68bf5497
ATTACK:ics:S1010 → uses → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c84e39ab-30c1-40e3-95a8-fcbb271e913c
Carl Hurd March 2019 · William Largent June 2018ATTACK:ics:M0942 → mitigates → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d16e8909-d055-4174-aeb1-22c0613b2f73
ATTACK:ics:M0802 → mitigates → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6ff74c2-d088-4252-a8e0-189574863765