Uncommon ARP Cache Listing via arp.exe

The Uncommon ARP Cache Listing via arp.exe alert indicates the uncommon listing of the ARP cache through the arp.exe command.

Synopsis

10 minutes.
3 days.
14 days.
10 minutes.
Traps endpoint data.
Discovery.

Description

The arp.exe command is used to display and modify entries in the Address Resolution Protocol (ARP) cache.

Attacker's Goals

Adversaries may attempt to use the command to discover remote systems they could compromise.

Related Documentation