t1200 | LoFP

t1200

Title	Tags
administrator may disable swapping of devices in a linux host. filter is needed.	t1200 endpoint splunk
likely	t1006 t1059 t1059.001 t1082 t1091 t1200 t1217 t1482 t1560 t1560.001 t1562 windows linux sigma
none currently known	t1200 t1498 t1557 T1557.002 infrastructure splunk
this search might be prone to high false positives if dhcp snooping has been incorrectly configured or in the unlikely event that the dhcp server has been moved to another network interface.	t1200 t1498 t1557 infrastructure splunk
this search might be prone to high false positives if dhcp snooping or arp inspection has been incorrectly configured, or if a device normally sends many arp packets (unlikely).	t1200 t1498 t1557 T1557.002 infrastructure splunk
this search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.	t1200 t1498 t1557 T1557.002 infrastructure splunk
this search will return false positives for any legitimate traffic captures by network administrators.	t1020 T1020.001 t1200 t1498 infrastructure splunk