macOS.Gaslight ARP Spoofing and TLS Certificate Pinning Failure on Local Network
This rule detects two distinct but related network-based adversary-in-the-middle (AiTM) techniques. The first part identifies ARP spoofing by looking for the same IP address being claimed by multiple MAC addresses within a short time frame, which can indicate an attacker is attempting to intercept local network traffic. The second part detects TLS certificate pinning failures, which can occur when an attacker attempts to perform a man-in-the-middle attack by presenting an untrusted or modified TLS certificate to a client that expects a specific certificate (pinning). This is often indicative of an attempt to intercept or decrypt encrypted network communications.
Microsoft Sentinel (KQL)
