> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# T0830 — Man in the Middle

> On-path adversaries who intercept or modify ICS communications.

**T0830 Man in the Middle** describes adversaries who position themselves between ICS components (engineering workstation ↔ PLC, SCADA ↔ RTU) to observe, modify, or replay traffic.

## Why ICS is vulnerable

Many industrial protocols (Modbus, classic S7, BACnet/IP, IEC 104 without 62351) lack strong mutual authentication. ARP spoofing, rogue gateways, or compromised jump hosts can place an attacker on-path with little protocol-level resistance. Stuxnet famously **replayed** normal process values to operators while damaging equipment — a classic MitM integrity attack.

## Observable patterns

* Unexpected ARP/gateway changes on OT VLANs
* Duplicate CIP/Modbus masters
* Latency or sequence anomalies on telecontrol links
* Internet-facing “proxies” that terminate ICS protocols

## Reyhford context

Internet honeypots primarily see **edge reconnaissance**, not full on-path plant attacks. We still map MitM-relevant technique tags when traffic patterns or enrichment imply spoofing/proxy tooling, and we document T0830 so SOC playbooks connect public IoCs to **internal** OT detection (SPAN, CIP Security, IEC 62351).

Related: [T0855](/mitre/t0855), [Modbus](/protocols/modbus), [IEC 104](/protocols/iec104).