ATT&CK T1557 - ARP Spoofing Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects Address Resolution Protocol (ARP) spoofing attempts by looking for ARP reply packets (opcode 2) on the network. A threshold is applied to trigger an alert if 20 or more ARP replies are observed from the same source within a 10-second window, which is indicative of malicious ARP activity.