AN1091
Analytic 1091
Windows
Detects anomalous ARP traffic or cache modifications on Windows endpoints that indicate ARP poisoning. Behavioral focus is on multiple IP addresses resolving to a single MAC, or unsolicited ARP replies from unauthorized devices.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Security
ARP cache modification attempts observed through event tracing or security baselines
[TrustedGatewayMAC]
Expected MAC address for default gateways; deviations may indicate poisoning.
[TimeWindow]
Correlation interval for repeated unsolicited ARP replies.
AN1092
Analytic 1092
Linux
Detects suspicious gratuitous ARP responses or inconsistent IP-to-MAC mappings using auditd and packet capture. Behavioral focus is on unsolicited replies overriding legitimate ARP ownership.
auditd:SYSCALL
setsockopt, ioctl modifying ARP entries
NSM:Flow
Gratuitous ARP replies with mismatched IP-MAC binding
[AllowedARPUpdates]
Expected legitimate IP-to-MAC updates for servers or virtual routers.
[AlertThreshold]
Number of anomalous ARP packets per second before triggering detection.
AN1093
Analytic 1093
macOS
Detects anomalous ARP cache changes and unsolicited ARP broadcasts using unified logs and packet capture. Behavioral detection includes multiple IP addresses mapped to the same MAC address and repeated gratuitous ARP traffic.
macos:unifiedlog
ARP table updates inconsistent with expected gateway or DHCP lease assignments
NSM:Flow
Excessive gratuitous ARP replies on local subnet
[GatewayMACBaseline]
Known MAC addresses for gateways or DHCP servers; used to detect spoofed ARP entries.
[CorrelationDepth]
How many ARP inconsistencies to tolerate before escalating detection.