A senior police officer, who did not want to be named as he was not authorised to speak to journalists, told The Straits Times that the two - identified as Rashid Kilala and Jiaher Guinar - were part of a cell in Quezon City's sprawling Novaliches district that security forces had been monitoring for over a month.
Three more suspects being hunted had already likely fled back to their jungle strongholds in the war-torn southern Mindanao islands, police chief Ronaldo de la Rosa said at a news conference yesterday.
The police officer told ST there were more than five members of the cell, including the group's financier.
Mr De la Rosa said all five were believed to be members of Ansar al Khilafah, a militant group with ties to another faction of extremists, the Maute group, which has also pledged allegiance to the Islamic State in Iraq and Syria (ISIS).
Maute was the target of a military operation this week, after it took parts of Butig town, in Lanao del Sur province, in Mindanao, 840km south of Manila, last Saturday.
The plot to bomb the US Embassy was initially said to be Maute's handiwork, to divert government attention from the Mindanao offensive.
Mr Rommel Banlaoi, an analyst with the Philippine Institute for Peace, Violence and Terrorism Research, said a relative of Omar Maute, one of the two founders of the Maute group killed early this year, was living in Novaliches.
"They have an existing network (in Metro Manila)," he said.
He added that the terrorist cell had long been planning a big attack in Manila to draw ISIS' attention.
It was behind an aborted plot to bomb venues during a summit of Apec world leaders in Manila in November last year, he said.
Mr De la Rosa said: "They were seeking to be recognised by ISIS, that they are good enough to mount attacks, because of the tremendous funding support they were hoping to get."
He added that with Manila under terror alert level 3, checkpoints and security were being increased around public places such as malls. He also predicted more police raids in pursuit of terror suspects.
The capital's last level 3 terror alert was on Dec 30, 2000, following multiple bombings that left 22 people dead.
Mr De la Rosa urged Filipinos not to be alarmed. "Just stay alert. Be cautious, but don't panic. Enjoy Christmas," he said.
Communications Minister Martin Andanar said the heightened alert "is consistent with the declaration of a state of national emergency or the declaration of a state of lawless violence" after the Davao bombing last September. "We assure the public that there will be no disruption in their normal lives," he said.