Threat intelligence / Technique

Sniffing Attacks

In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient. Sniffing Attacks are similar to Adversary-In-The-Middle attacks (CAPEC-94), but are entirely passive. AiTM attacks are predominantly active and often alter the content of the communications themselves.

Technique

TypeTechnique

External ID—

First seen2026-10-17

Last seen2026-10-17

Confidence

—

In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient. Sniffing Attacks are similar to Adversary-In-The-Middle attacks (CAPEC-94), but are entirely passive. AiTM attacks are predominantly active and often alter the content of the communications themselves.

Labels

attack-patterncapec

7 recorded

Relationships

child-of

from Accessing/Intercepting/Modifying HTTP Cookies

Technique

child-of

from Cellular Traffic Intercept

Technique

child-of

from Sniff Application Code

Technique

child-of

to Interception

Technique

child-of

from Sniffing Network Traffic

Technique

child-of

from Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

Technique

related-to

from CVE-2026-34486

Vulnerability

1 external

References

capec

CAPEC-157