tfMITRE ATT&CK sub-technique

ARP Cache Poisoning T1557.002

sub-technique of T1557 Adversary-in-the-Middle

Tactics: Credential Access, Collection
Platforms: Linux, Windows, macOS
Version: 1.1
Created: 15 October 2020
Last modified: 24 October 2025
Contributor: Jon Sternstein, Stern Security

Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

ARP Cache Poisoning MITRE reference T1557.002

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

LuminousMothG1014 ↗

Has used ARP spoofing to redirect a compromised machine to an actor-controlled website.1

created 2023-02-231 reference

CleaverG0003 ↗

Has used custom tools to facilitate ARP cache poisoning.1

created 2017-05-311 referenceaka Threat Group 2889

All 2 groups for this technique

Offense vs defense T1557.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 3

first rule: 2020 Q3

ARP Cache Poisoning detection strategy DET0387

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect ARP Cache Poisoning Across Linux, Windows, and macOS

Enterprise

3 platforms

AN1091 · Windows

Detects anomalous ARP traffic or cache modifications on Windows endpoints that indicate ARP poisoning. Behavioral focus is on multiple IP addresses resolving to a single MAC, or unsolicited ARP replies from unauthorized devices.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	WinEventLog:Security	ARP cache modification attempts observed through event tracing or security baselines
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TrustedGatewayMAC	Expected MAC address for default gateways; deviations may indicate poisoning.
TimeWindow	Correlation interval for repeated unsolicited ARP replies.

AN1092 · Linux

Detects suspicious gratuitous ARP responses or inconsistent IP-to-MAC mappings using auditd and packet capture. Behavioral focus is on unsolicited replies overriding legitimate ARP ownership.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	Gratuitous ARP replies with mismatched IP-MAC binding
Network Traffic ContentDC0085	auditd:SYSCALL	setsockopt, ioctl modifying ARP entries

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedARPUpdates	Expected legitimate IP-to-MAC updates for servers or virtual routers.
AlertThreshold	Number of anomalous ARP packets per second before triggering detection.

AN1093 · macOS

Detects anomalous ARP cache changes and unsolicited ARP broadcasts using unified logs and packet capture. Behavioral detection includes multiple IP addresses mapped to the same MAC address and repeated gratuitous ARP traffic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	macos:unifiedlog	ARP table updates inconsistent with expected gateway or DHCP lease assignments
Network Traffic ContentDC0085	NSM:Flow	Excessive gratuitous ARP replies on local subnet

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
GatewayMACBaseline	Known MAC addresses for gateways or DHCP servers; used to detect spoofed ARP entries.
CorrelationDepth	How many ARP inconsistencies to tolerate before escalating detection.

ARP Cache Poisoning detections T1557.002

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs