Skip to content

README.md

Latest commit

 

History

History
42 lines (27 loc) · 2.53 KB

README.md

File metadata and controls

42 lines (27 loc) · 2.53 KB

IOC 13 – ARP Spoofing Case Study

This project provides a forensic walkthrough of a real-world network redirection technique using ARP spoofing. It highlights the challenges of detecting unauthorized Layer 2 manipulation from a host perspective and demonstrates how attackers exploit trust and stateless protocols to intercept traffic, harvest credentials, and reroute communications within local networks.

Overview

The case study centers on a hostile actor who has already gained access to a local subnet and proceeds to execute an Address Resolution Protocol (ARP) spoofing attack. This mid-stage maneuver involves broadcasting forged ARP replies to mislead nearby hosts about the legitimate MAC address associated with a critical IP (e.g., gateway or DNS server). This tactic positions the attacker as a man-in-the-middle, enabling credential theft, session hijacking, and lateral movement.

Key Topics Covered

  • How ARP functions at OSI Layer 2 and why it’s vulnerable
  • The role of operating system behavior in enabling packet-level deception
  • Use of promiscuous mode and raw socket manipulation
  • Triage techniques for identifying ARP-related anomalies from host systems
  • Forensic linkage between process execution, network interfaces, and malicious behavior

Investigative Breakdown

This project follows a structured triage format:

  • Telemetry Sources: PCAP, NetFlow, Windows Event Logs, Volatile Memory
  • Host-Based Detection Techniques: Process analysis, EDR inspection, registry and memory review
  • Cross-Layer Mapping: From credential theft to execution, background persistence, and interface-level activity
  • OSI Model Integration: Focused on Layer 2 exploitation with implications at Layers 3 and 7
  • Defender Response Strategy: ARP table validation, Wireshark filtering, gateway integrity checks, switch-level enforcement using Dynamic ARP Inspection (DAI)

Educational Value

This analysis is designed to reinforce structured cybersecurity thinking:

  • Understand how attacks unfold inside a network, after initial compromise
  • Learn to map attacker behavior to observable host and network signals
  • Strengthen your command of forensic triage tools and methods
  • See how operating system layers interact with low-level protocols like ARP

Files

  • ioc13-arp-spoofing.ipynb: Full case study notebook with embedded technical explanations and strategic commentary

License

This project is open source and available for educational and defensive research purposes. Attribution encouraged.