Uncommon ARP Cache Listing via arp.exe

The
Uncommon ARP Cache Listing via arp.exe
Analytics alert indicates the uncommon listing of the ARP cache through the arp.exe command.

Synopsis

10 minutes
3 days
14 days
10 minutes
Cortex XDR agent endpoint data.
Severity
Low

Description

The arp.exe command is used to display and modify entries in the Address Resolution Protocol (ARP) cache.

Attacker's Goals

Adversaries may attempt to use the command to discover remote systems they could compromise.

Recommended For You