T1557.002No distinct observable

ARP Cache Poisoning

Credential Access · CollectionLinux, Windows, macOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

No log source in the brief can carry an ARP frame or an ARP cache write. AN1091 offers Sysmon EventID 3 (network_connection) and EventID 22 (dns_query): EID 3 is written for established TCP/UDP sockets and its fields are SourceIp/DestinationIp/DestinationPort/Protocol, none of which exist for ARP, which is a layer-2 broadcast with no IP header and no owning process, so any selection written there is dead on arrival; dns_query is a different protocol entirely and unrelated to this technique. AN1092 names auditd setsockopt/ioctl calls modifying ARP entries, but the Sigma auditd field model exposes only type/syscall/exe/key — it carries neither the ioctl request code (SIOCSARP) nor the IP-to-MAC pair being written, so the only expressible rule is 'syscall=ioctl', which fires on every process on the host continuously and identifies nothing. […]

Covered instead by T1557, T1040.

What the technique is

Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address. Devices in a local network segment communicate with each other by using link layer addresses. If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. The device with the associated IP address directly replies with its MAC address. The networked device that made the ARP request will then use as well as store that information in its ARP cache. An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. […]

Read it on attack.mitre.org

What MITRE says you would watch

AN1091
Detects anomalous ARP traffic or cache modifications on Windows endpoints that indicate ARP poisoning. Behavioral focus is on multiple IP addresses resolving to a single MAC, or unsolicited ARP replies from unauthorized devices.
AN1092
Detects suspicious gratuitous ARP responses or inconsistent IP-to-MAC mappings using auditd and packet capture. Behavioral focus is on unsolicited replies overriding legitimate ARP ownership.
AN1093
Detects anomalous ARP cache changes and unsolicited ARP broadcasts using unified logs and packet capture. Behavioral detection includes multiple IP addresses mapped to the same MAC address and repeated gratuitous ARP traffic.