Techniques › T1557.002 › AN1093
AN1093 Analytic 1093
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects anomalous ARP cache changes and unsolicited ARP broadcasts using unified logs and packet capture. Behavioral detection includes multiple IP addresses mapped to the same MAC address and repeated gratuitous ARP traffic.</p>
- Detects
- T1557.002 ARP Cache Poisoning
- Part of
- DET0387 Detect ARP Cache Poisoning Across Linux, Windows, and macOS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | ARP table updates inconsistent with expected gateway or DHCP lease assignments | DC0078 Network Traffic Flow |
| NSM:Flow | Excessive gratuitous ARP replies on local subnet | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
GatewayMACBaseline | Known MAC addresses for gateways or DHCP servers; used to detect spoofed ARP entries. |
CorrelationDepth | How many ARP inconsistencies to tolerate before escalating detection. |