S0099: Arp
Security context for executives and security teams
Arp is a legitimate built-in utility used to view or change a system’s ARP cache. Its security significance is that adversaries can use normal administrative tooling to understand local network neighbors and support discovery before lateral movement. Because it is native on Windows, Linux, and macOS, the business risk is not the tool itself but whether the organization can distinguish expected troubleshooting from suspicious discovery behavior during an incident.
Executive priority
Treat Arp coverage as a test of basic endpoint and network visibility, not as a standalone high-severity alert. Leaders should ask whether SOC and incident response teams can reconstruct local network discovery activity from native tools across workstations and servers. This matters for resilience because ATT&CK relationships connect Arp to System Network Configuration Discovery and Remote System Discovery, and relationship context includes espionage, ransomware, and destructive campaign reporting, including energy-sector cyber-physical relevance in the supplied campaign descriptions.
Technical view
For SOC and IR teams, validate visibility into Arp execution and command-line context on Windows, Linux, and macOS. The most useful analysis is relationship-driven: Arp activity becomes more meaningful when clustered with other discovery behaviors tied to T1016 and T1018, unusual parent processes, recently established remote access, suspicious user context, or follow-on lateral movement indicators. MITRE provides no official detection logic for this tool, so local baselining is required to separate routine network troubleshooting and administration from attacker discovery.
Likely telemetry
- Endpoint process creation events with executable name, path, arguments, parent process, user, host, and timestamp
- Shell history or command audit logs where available on Linux and macOS
- Windows command-line auditing or equivalent EDR telemetry
- Authentication and session context around the same host and user
- Network telemetry showing local subnet scanning or neighbor discovery patterns near Arp execution
Detection direction
- Baseline normal Arp usage by IT administrators, network teams, server roles, and troubleshooting workflows before alerting aggressively.
- Correlate Arp execution with other discovery utilities and ATT&CK-related discovery behavior rather than treating a single execution as inherently malicious.
- Prioritize investigation when Arp is launched by unusual parent processes, scripts, malware-like staging paths, remote shells, or non-administrative users.
- Tune for bursty or repeated discovery activity across multiple hosts, especially when followed by authentication attempts or remote connection activity.
- Account for false positives from legitimate diagnostics, endpoint agents, network troubleshooting, and incident response activity.
Mitigation priorities
- Ensure endpoint logging captures process creation and command-line arguments across Windows, Linux, and macOS.
- Restrict unnecessary administrative access so discovery from one compromised account has less operational reach.
- Maintain asset and network segmentation context so discovery activity can be assessed against expected host roles and business-critical zones.
- Use SOC playbooks that correlate native-tool discovery with identity, remote access, and lateral movement evidence.
- For environments with operational technology or distributed infrastructure exposure, validate that discovery telemetry and segmentation assumptions extend to systems that could affect continuity.
Additional notes and limits
Arp is a dual-use native utility, so the defensive value comes from context. The supplied ATT&CK relationships show use by multiple groups and campaigns and link the tool to discovery techniques T1016 and T1018. Those relationships justify monitoring and correlation, but they do not make every Arp execution suspicious.
The ATT&CK object provides a short description and no official detection guidance. Tactics are not specified on the tool object itself, and detection recommendations must therefore be validated against local operating systems, logging configuration, administrative workflows, and asset roles. The relationship context supports relevance but does not prove current exposure or active exploitation in any specific environment.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Arp
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1018 | Remote System Discovery | |
| Enterprise | T1016 | System Network Configuration Discovery |
Groups, software, and campaigns
G0010: Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
G1043: BlackByte
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]
G0050: APT32
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]
G0071: Orangeworm
Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.[1] Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.[2]
C0063: 2025 Poland Wiper Attacks
2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]
C0060: Operation AkaiRyū
Operation AkaiRyū (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by MirrorFace between June and September 2024 against entities in Japan and Central Europe. Operation AkaiRyū notably included the first reported targeting of a European entity by MirrorFace, as well as their use of UPPERCUT, which was thought to be exclusive to menuPass.[1][2]
C0026: C0026
C0026 was a campaign identified in September 2022 that included the selective distribution of KOPILUWAK and QUIETCANARY malware to previous ANDROMEDA malware victims in Ukraine through re-registered ANDROMEDA C2 domains. Several tools and tactics used during C0026 were consistent with historic Turla operations.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | 27f346173ede… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]TechNet Arp
Microsoft. (n.d.). Arp. Retrieved April 17, 2016.
Open source URL - [2]Kaspersky Turla
Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
Open source URL - [3]CERT Polska
CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.
Open source URL - [4]FBI BlackByte 2022
US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.
Open source URL - [5]Trend Micro Earth Kasha Anel NOV 2024
Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.
Open source URL - [6]Palo Alto ARP
Palo Alto Networks. (2021, November 24). Cortex XDR Analytics Alert Reference: Uncommon ARP cache listing via arp.exe. Retrieved December 7, 2021.
Open source URL - [7]Cybereason Cobalt Kitty 2017
Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
Open source URL - [8]Symantec Orangeworm April 2018
Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
Open source URL - [9]Mandiant Suspected Turla Campaign February 2023
Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
Open source URL - [10]TechNet Arp
Microsoft. (n.d.). Arp. Retrieved April 17, 2016.
Open source URL - [11]TechNet Arp
Microsoft. (n.d.). Arp. Retrieved April 17, 2016.
Open source URL - [12]mitre-attackS0099Open source URL
- [13]mitre-attackS0099Open source URL
- [14]mitre-attackS0099Open source URL
- [15]Kaspersky Turla
Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
Open source URL - [16]CERT Polska
CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.
Open source URL - [17]FBI BlackByte 2022
US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.
Open source URL - [18]Trend Micro Earth Kasha Anel NOV 2024
Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.
Open source URL - [19]Palo Alto ARP
Palo Alto Networks. (2021, November 24). Cortex XDR Analytics Alert Reference: Uncommon ARP cache listing via arp.exe. Retrieved December 7, 2021.
Open source URL - [20]TechNet Arp
Microsoft. (n.d.). Arp. Retrieved April 17, 2016.
Open source URL - [21]TechNet Arp
Microsoft. (n.d.). Arp. Retrieved April 17, 2016.
Open source URL - [22]Cybereason Cobalt Kitty 2017
Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
Open source URL - [23]Symantec Orangeworm April 2018
Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
Open source URL - [24]TechNet Arp
Microsoft. (n.d.). Arp. Retrieved April 17, 2016.
Open source URL - [25]TechNet Arp
Microsoft. (n.d.). Arp. Retrieved April 17, 2016.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.