macOS Remote System Discovery via arp or ping enumeration

title: macOS Remote System Discovery via arp or ping enumeration
id: af348089-c179-42e6-8650-93e6577aab52
status: test
description: This rule flags macOS process executions where arp is run with '-a' or ping is used with target IPs in common private or local ranges. Enumerating reachable systems is a common step in network discovery and can support later lateral movement and targeting. It relies on process creation telemetry, matching the executed binary path and specific command-line arguments and IP substrings.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_remote_system_discovery.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-22
modified: 2021-11-27
tags:
  - attack.discovery
  - attack.t1018
logsource:
  category: process_creation
  product: macos
detection:
  selection_1:
    Image|endswith: /arp
    CommandLine|contains: -a
  selection_2:
    Image|endswith: /ping
    CommandLine|contains:
      - " 10."
      - " 192.168."
      - " 172.16."
      - " 172.17."
      - " 172.18."
      - " 172.19."
      - " 172.20."
      - " 172.21."
      - " 172.22."
      - " 172.23."
      - " 172.24."
      - " 172.25."
      - " 172.26."
      - " 172.27."
      - " 172.28."
      - " 172.29."
      - " 172.30."
      - " 172.31."
      - " 127."
      - " 169.254."
  condition: 1 of selection*
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: 10227522-8429-47e6-a301-f2b2d014e7ad
    type: derived