Currently viewing ATT&CK v7.2 which was live between July 8, 2020 and October 26, 2020. Learn more about the versioning system or see the live site.
Register to stream the next session of ATT&CKcon Power Hour November 12
SOFTWARE
Aria-body
SOFTWARE
1-9
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Y-Z
  1. Home
  2. Software
  3. Arp

Arp

Arp displays information about a system's Address Resolution Protocol (ARP) cache. [1]

ID: S0099
Associated Software: arp.exe
Type: TOOL
Platforms: Linux, Windows, macOS
Version: 1.0
Created: 31 May 2017
Last Modified: 17 October 2018
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1016 System Network Configuration Discovery

Arp can be used to display ARP configuration information on the host.

Groups That Use This Software

ID Name References
G0010 Turla

[2]
G0071 Orangeworm

[3]
G0050 APT32

[4]

References

  1. Microsoft. (n.d.). Arp. Retrieved April 17, 2016.
  2. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  1. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  2. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.