Home/ CVE-2024-54840/ Attack path

Attack path: ARP Cache Poisoning

Kill-chain expansion via actor co-occurrence analysis  ·  10 techniques  ·  7 detectable  ·  3 detection gaps
Entry point: CVE-2024-54840 T1557.002
Other
T1027.013
Encrypted/Encoded File
× no rule
1.7x lift
T1027.005
Indicator Removal from Tools
✓ sigma
Resource Dev
T1583.003
Virtual Private Server
× no rule
1.8x lift
Initial Access
T1199
Trusted Relationship
✓ sigma
2.1x lift
Credential Access
T1557.002
ARP Cache Poisoning
× no rule
999.0x lift
T1557
Adversary-in-the-Middle
✓ sigma
11.3x lift
T1552
Unsecured Credentials
✓ sigma
C2
T1102.002
Bidirectional Communication
✓ sigma
2.8x lift
T1568.002
Domain Generation Algorithms
✓ sigma
1.6x lift
T1102
Web Service
✓ sigma
Entry point (from CVE) Detection rule available Detection gap - potential blind spot Lift = how strongly this technique co-occurs with the entry point across shared threat actors (1x = expected, 5x = highly distinctive)
Hunt package
All 10 techniques in this chain - Sigma rules, Atomic tests, and detection gaps in one view.
Sigma rules Full technique
SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Recently exploited
Daily brief
Change tracking
Detection Engineering
Coverage workspace
Detection coverage
Coverage check
Telemetry ceiling
SIEM query builder
Sigma rules
SIEM rules
YARA rules
Network rules
D3FEND
Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Atomic tests
Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation
Compliance and GRC
Framework mapping
Control assessment
Audit view
Atlas Search Threat actors Techniques Tools & malware CWE CAPEC KEV catalog Package vulns
About All capabilities Pricing API docs Live status Privacy policy Terms of service
threatengine.sh