T1557.002 — ARP Cache Poisoning

Tactics: Credential Access, Collection · Platforms: Linux, Windows, macOS

Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. The ARP protocol is used to resolve…

Sub-technique of Adversary-in-the-Middle (T1557).

Sigma detection rules (3)

T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning

title: "T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning"
id: ceb44d6c-2f54-4dbb-afb0-ffbcadc5749c
description: 'Windows/Sysmon telemetry has no ARP-layer visibility, so ARP cache poisoning cannot be detected directly; this rule instead uses the closest Windows-observable proxy, detecting local static ARP table injection via arp.exe -s or netsh interface neighbor-table manipulation, which an adversary may use to pin a spoofed MAC-to-IP mapping. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TrustedGatewayMAC, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1557/002
author: Shahrukh Khan
date: 2026-04-16
license: MIT
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_arp:
    Image|endswith: '\arp.exe'
    CommandLine|contains: '-s'

  selection_netsh:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'interface'
      - 'add'
      - 'neighbors'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_arp or selection_netsh) and not filter_system_account

falsepositives:
  - Legitimate static ARP entries configured by network administrators or provisioning/imaging scripts.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning

title: "T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning"
id: 00c982b3-a806-4f71-be16-619d22b5850f
description: 'Detect ARP Cache Poisoning Across Linux, Windows, and macOS. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedARPUpdates, AlertThreshold.'
references:
  - https://attack.mitre.org/techniques/T1557/002
author: Shahrukh Khan
date: 2026-06-01
license: MIT
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/arpspoof'
      - '/ettercap'

  condition: selection

falsepositives:
  - ARP cache poisoning itself is a layer-2 event auditd cannot observe directly (no ARP table telemetry); this rule only catches the attacker tool's process launch, not the actual spoofed ARP replies — a genuine network-layer sensor is required for the ARPThreshold logic.

level: high

T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning

title: "T1557.002 Adversary-in-the-Middle: ARP Cache Poisoning"
id: 29f41b3e-3d5d-4247-ba86-32a08f45b38d
description: 'Detect ARP Cache Poisoning Across Linux, Windows, and macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: GatewayMACBaseline, CorrelationDepth.'
references:
  - https://attack.mitre.org/techniques/T1557/002
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/arp'
    CommandLine|contains: '-s'

  condition: selection

falsepositives:
  - Network administrators manually pinning a static ARP entry for a known device during troubleshooting.

level: high

Related sub-techniques

Explore