tool

Arp S0099

Type: tool
Platforms: Linux, Windows, macOS
Created: 31 May 2017
Last modified: 12 May 2026

Arp displays and modifies information about a system's Address Resolution Protocol (ARP) cache. [1]

TechniquesBottom 7%

TacticBottom 6%

Threat groupsunranked

Campaignsunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Arp MITRE reference S0099

System Network Configuration Discovery T1016 ↗

Arp can be used to display ARP configuration information on the host.2

Discovery25 detection rules

Remote System Discovery T1018 ↗

Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.3 4

Discovery39 detection rules

Standing S0099

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques2Bottom 7%

7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat groups461% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns385% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique32medTop 20%

80th percentile · 80% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique16.5medTop 2%

98th percentile · 98% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique3med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0medBottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 2 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 3Sigma rules (cumulative) · 29Splunk ESCU (cumulative) · 33

Standing S0099

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480
Splunk	The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-07-20	41243735-89a7-4c83-bcdd-570aa78f00a1
Splunk	The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	64c7adaa-48ee-483c-b0d6-7175bc65e6cc
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-18	0e4164da-94bc-450d-a7be-a4b176179f1f
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	c5a31f80-5888-4d81-9f78-1cc65026316e
Splunk	The following analytic detects the execution of the `Get-AdComputer` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	a9a1da02-8e27-4bf7-a348-f4389c9da487
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	ed550c19-712e-43f6-bd19-6f58f61b3a5e
Splunk	The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	f64da023-b988-4775-8d57-38e512beb56e
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-DomainController` command, which is used to discover remote systems within a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	868ee0e4-52ab-484a-833a-6d85b7c028d0
Splunk	The following analytic detects the execution of the `Get-DomainController` commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	676b600a-a94d-4951-b346-11329431e6c1
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3
Splunk	The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_Computer` class parameter via PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	29b99201-723c-4118-847a-db2b3d3fb8ea
	Detects execution of the hacktool NetExec. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Remote Services Discovery Remote System Discovery	-	high	Chirag Damani	2026-03-29	—	7638e5fe-600c-4289-a968-f49dd537ec7d
Splunk	The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-10-02	5db16825-81bd-4923-a8d6-d6a13a59832a
	Detects the enumeration of other remote systems.	Generic	test	process_creation	linux	Sysmon	Discovery Remote System Discovery	-	low	Alejandro Ortuno, oscd.community	2020-10-22	2021-11-27	11063ec2-de63-4153-935e-b1a8b9e616f1
Splunk	The following analytic identifies potential enumeration of local network configuration on Linux systems. (...)	Anomaly	stable	process_creation	linux	Sysmon · Osquery	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2022-02-14	2026-10-02	535cb214-8b47-11ec-a2c7-acde48001122
	Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.	Hunting	test	ps_module	windows	PowerShell	Discovery Software Discovery Security Software Discovery Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-07-13	—	ea207a23-b441-4a17-9f76-ad5be47d51d3
Splunk	This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall. (...)	Anomaly	stable	process_creation	-	Osquery	Discovery System Network Configuration Discovery	-	medium	Jamie Windley, Splunk	2026-04-15	2026-10-02	f8db6e0b-55bb-40ca-bc85-2b3700adb0f8
	Detects the enumeration of other remote systems.	Generic	test	process_creation	macos	-	Discovery Remote System Discovery	-	informational	Alejandro Ortuno, oscd.community	2020-10-22	2021-11-27	10227522-8429-47e6-a301-f2b2d014e7ad
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Remote System Discovery Discovery System Network Configuration Discovery	-	low	Arun Chauhan	2023-02-03	—	903076ff-f442-475a-b667-4f246bcc203b
	Detects instances where an SNMP service on an OpenCanary node has had an OID request.	Generic	test	-	-	OpenCanary	Lateral Movement Remote Services Discovery System Network Configuration Discovery	-	high	Security Onion Solutions	2024-03-08	—	e9856028-fd4e-46e6-b3d1-10f7ceb95078
	Detects network enumeration performed on AWS.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Discovery System Network Configuration Discovery	-	low	Janantha Marasinghe	2022-12-13	2023-03-24	c3d53999-4b14-4ddd-9d9b-e618c366b54d
	Detects system discovery activity carried out by Pikabot, such as incl. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery	-	high	Andreas Braathen (mnemonic.io)	2023-10-27	2024-01-26	698d4431-514f-4c82-af4d-cf573872a9f5
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery System Network Configuration Discovery	-	medium	Craig Young, oscd.community, Georg Lauenstein	2021-07-24	2023-12-15	5cc90652-4cbd-4241-aa3b-4b462fa5a248
Splunk	The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Configuration Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	3f0b95e3-3195-46ac-bea3-84fb59e7fac5	-
	Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.	Generic	experimental	ps_script	windows	PowerShell	Reconnaissance Gather Victim Identity Information Email Addresses Discovery Remote System Discovery Credential Access Steal or Forge Kerberos Tickets	-	medium	frack113	2025-03-05	—	cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
	Detects AdFind execution with common flags seen used during attacks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community	2021-02-02	2025-10-24	9a132afa-654e-11eb-ae93-0242ac130002
	This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of int (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Remote System Discovery	-	low	frack113	2022-01-01	2023-02-21	26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell scripts to query Active Directory for domain computers. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	70803451-0047-4e12-9d63-77fa7eb8649c
Splunk	The following analytic detects the execution of `dsquery.exe` with the `computer` argument, which is used to discover remote systems within a domain. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	9fb562f4-42f8-4139-8e11-a82edf7ed718
Splunk	The following analytic detects the execution of `wmic.exe` with specific command-line arguments used to discover remote systems within a domain. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	d82eced3-b1dc-42ab-859e-a2fc98827359
	Detects the use of a renamed Adfind.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Florian Roth (Nextron Systems)	2022-08-21	2025-02-26	df55196f-f105-44d3-a675-e9dfb6cc2f2b
	Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Discovery Remote System Discovery	-	low	Endgame, JHasenbusch (ported for oscd.community)	2018-10-30	2023-02-21	62510e69-616b-4078-b371-847da438cc03
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-19	a29c1813-ab1f-4dde-b489-330b952e91ae
	Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". (...)	Generic	test	network_connection	windows	Sysmon	Discovery System Network Configuration Discovery	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-04-24	2024-03-22	edf3485d-dac4-4d50-90e4-b0e5813f7e60
	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery Remote System Discovery	-	medium	frack113	2022-03-12	—	f8ad2e2c-40b6-4117-84d7-20b89896ab23
	Detects enumeration of local network configuration	Generic	test	process_creation	linux	Sysmon	Discovery System Network Configuration Discovery	-	informational	Ömer Günal and remotephone, oscd.community	2020-10-06	2022-09-15	e7bd1cfa-b446-4c88-8afb-403bcd79e3fa
	Detects enumeration of local network configuration	Generic	test	process_creation	macos	-	Discovery System Network Configuration Discovery	-	informational	remotephone, oscd.community	2020-10-06	2024-08-29	58800443-f9fc-4d55-ae0c-98a3966dfb97
	Detects suspicious enumeration of the domain the user is associated with.	Placeholder	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-02-09	2024-08-01	43311e65-84d8-42a5-b3d4-c94d9b67038f
	Detects certain command line parameters often used during reconnaissance activity via web shells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	-	high	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson	2017-01-01	2026-07-14	bed2a484-9348-4143-8a8a-b801c979301c

Title

Description