Identifier / Programs / Linux and Unix
arp
Show and manipulate your system's ARP cache. tldr-pages
GTFOBins file-read 3 Sigma rules name it 1 documented command
How arp is abused
file-read
-v-fEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for arp.
1 documented command
file-read unprivileged, with sudo, as SUID
Lines are likely leaked as error messages.
arp -v -f /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for arp. The identifier reads the line that runs arp.
What detects it
Everyday use
Show the current ARP table
arpIdentifyShow alternative BSD style output format with on fixed columns
arp -aIdentifyTrips 2 Sigma rules: lowLinux Remote System Discovery by Alejandro Ortuno, oscd.community; informationalMacos Remote System Discovery by Alejandro Ortuno, oscd.community
delete a specific entry
sudo arp -d addressIdentifyOf the 3 examples the identifier reads, 1 matches GTFOBins abuse or trips a Sigma process-creation rule.