Arp Cache Discovery#

Metadata#

Contributors

Roberto Rodriguez @Cyb3rWard0g

Creation Date

2020/11/10

Modification Date

2020/11/10

Tactics

TA0007

Techniques

T1018

Tags

None

Dataset Description#

This dataset represents a threat actor using arp to list out the arp cache.

Simulation Metadata#

Tools#

type

Name

Module

Manual

sh

sh

Adversary View#

wardog@UBUNTU5:~$ arp -a | grep -v '^?'
_gateway (192.168.2.1) at 12:34:56:78:9a:bc [ether] on eth0

Explore Datasets#

Download & Decompress Dataset#

import requests
from zipfile import ZipFile
from io import BytesIO

url = https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/linux/discovery/host/sh_arp_cache.zip
zipFileRequest = requests.get(url)
zipFile = ZipFile(BytesIO(zipFileRequest.content))
datasetJSONPath = zipFile.extract(zipFile.namelist()[0])

Read JSON File#

from pandas.io import json

df = json.read_json(path_or_buf=datasetJSONPath, lines=True)

Access Security Events#

df.head(1)