Uncommon ARP cache listing via arp.exe

Analytics BIOC Low

Uncommon ARP cache listing via arp.exe

The arp.exe command is used to display and modify entries in the Address Resolution Protocol (ARP) cache. Adversaries may attempt to use the command to discover remote systems they could compromise.

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: System Network Configuration Discovery (T1016)

Attacker's goals:

Adversaries may attempt to use the command to discover remote systems they could compromise.

Investigative actions:

Check whether the initiating process is allowed in your organization. (If the parent process is cmd.exe, check the process that spawned it).

Test period:: N/A (single event)
Deduplication:: 1 Hour