AN1093: Analytic 1093
Detects anomalous ARP cache changes and unsolicited ARP broadcasts using unified logs and packet capture. Behavioral detection includes multiple IP addresses mapped to the same MAC address and repeated gratuitous ARP traffic.
Analyst context for executives and security teams
AN1093 is a macOS-focused detection analytic for suspicious local network ARP behavior, such as unexpected ARP cache changes, multiple IP addresses resolving to the same MAC address, and repeated gratuitous ARP traffic. For leaders, the value is in validating whether endpoint and network monitoring can see local network manipulation signals that may affect user trust, incident scoping, and continuity on shared networks.
Executive priority
Prioritize this analytic where macOS systems operate on business-critical LANs, executive networks, lab environments, or operational segments where local network integrity matters. The decision point is not just whether a rule exists, but whether the organization has the packet capture and macOS unified log visibility needed to prove or disprove abnormal ARP activity during an investigation.
Technical view
SOC and detection teams should validate collection from macOS unified logs and packet capture sources, then test logic for anomalous ARP cache changes, repeated unsolicited or gratuitous ARP broadcasts, and cases where multiple IP addresses map to the same MAC address. Because no ATT&CK tactic or relationship context is supplied, this should be treated as a network-behavior analytic rather than mapped to a broader intrusion sequence without local evidence.
Likely telemetry
- macOS unified logs related to network or ARP behavior
- Packet capture or network sensor records containing ARP traffic
- ARP cache state or change observations from macOS endpoints
- Network evidence showing repeated gratuitous ARP broadcasts
- Network evidence showing multiple IP addresses associated with the same MAC address
Detection direction
- Confirm that macOS unified logs are collected, retained, and searchable for the endpoints in scope.
- Confirm that packet capture or equivalent network telemetry includes ARP traffic on relevant local segments.
- Tune for behavioral patterns noted by MITRE: anomalous ARP cache changes, repeated gratuitous ARP traffic, and multiple IP-to-one-MAC mappings.
- Account for benign causes such as network reconfiguration, failover, virtualization, or address management behavior before escalating.
- Use this analytic as supporting evidence in investigations; the supplied object does not provide tactic, technique, or relationship context.
Mitigation priorities
- Establish visibility first: ensure macOS endpoint logging and local network packet telemetry are available where this risk matters.
- Baseline expected ARP behavior on important network segments to reduce false positives.
- Define SOC triage steps for validating whether ARP anomalies align with legitimate infrastructure changes.
- Coordinate network, endpoint, and incident response teams so local network anomalies can be quickly scoped.
- Use findings to inform broader network segmentation, monitoring, and incident response readiness decisions where local network integrity is business-critical.
Analyst notes and limits
This object is a detection analytic, not a technique description. The supplied ATT&CK fields identify macOS as the platform and describe ARP-focused behavioral detection using unified logs and packet capture. No tactics, relationships, aliases, or official detection implementation details were supplied.
No official detection logic, data component mapping, ATT&CK tactic, related technique, or relationship context was provided. Local environment baselines are required to distinguish malicious or suspicious ARP behavior from legitimate network operations.
Analytic 1093
Detects anomalous ARP cache changes and unsolicited ARP broadcasts using unified logs and packet capture. Behavioral detection includes multiple IP addresses mapped to the same MAC address and repeated gratuitous ARP traffic.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 14cc1d998acd… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1093Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.