Arp
Software · ATTACK:enterprise:S0099
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0099",
"title": "Arp",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0099",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--30489451-5886-4c46-90c9-0dff9adc5252",
"external_id": "S0099",
"domain": "enterprise",
"created": "2017-05-31T21:33:02.428Z",
"modified": "2026-05-12T15:12:00.740Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "TechNet Arp",
"url": "https://technet.microsoft.com/en-us/library/bb490864.aspx"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c0645e4-f0c7-4bb4-bedb-29a96a472fe0
Kaspersky TurlaATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7231504b-153b-454a-a092-b5b2d01609e2
CERT PolskaATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f097447-429c-4a28-b333-78936f11e0c0
FBI BlackByte 2022ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95b3df3d-a1c9-421e-a1c4-8cdb2f0e75c0
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:S0099 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be4040ce-c8cf-408d-b126-0954bbc1545b
TechNet Arp · Palo Alto ARPATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9660ab0-33d4-434d-833f-cc1969b04f7a
Cybereason Cobalt Kitty 2017ATTACK:enterprise:G0071 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc6e0159-1216-4ca5-ac5c-55e961878785
Symantec Orangeworm April 2018ATTACK:enterprise:S0099 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4fd461f-fc58-4060-aed4-cebe64f249b9
TechNet ArpATTACK:enterprise:C0026 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0a83a2e-f0c5-4d3d-b053-9a56ef9f7b8e
Mandiant Suspected Turla Campaign February 2023