1200KM / tool
Arp — Attack Tool
Arp displays and modifies information about a system's Address Resolution Protocol (ARP) cache.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: Arp, arp.exe
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Turla · G0010 · Pinned relationship source (relationship--5c0645e4-f0c7-4bb4-bedb-29a96a472fe0)
- APT32 · G0050 · Pinned relationship source (relationship--c9660ab0-33d4-434d-833f-cc1969b04f7a)
- Orangeworm · G0071 · Pinned relationship source (relationship--cc6e0159-1216-4ca5-ac5c-55e961878785)
- BlackByte · G1043 · Pinned relationship source (relationship--8f097447-429c-4a28-b333-78936f11e0c0)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.