SigmaHQ/rules/windows/builtin/win_susp_dhcp_config_failed.yml

title: DHCP Server Error Failed Loading the CallOut DLL
id: 75edd3fd-7146-48e5-9848-3013d7f0282c
description: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded
status: experimental
references:
    - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
    - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
    - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
date: 2017/05/15
modified: 2019/07/17
tags:
    - attack.defense_evasion
    - attack.t1073           # an old one
    - attack.t1574.002
author: "Dimitrios Slamaris, @atc_project (fix)"
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID:
            - 1031
            - 1032
            - 1034
        Source: Microsoft-Windows-DHCP-Server
    condition: selection
falsepositives:
    - Unknown
level: critical
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`title: DHCP Server Error Failed Loading the CallOut DLL`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 75edd3fd-7146-48e5-9848-3013d7f0282c`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`description: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded`
			`status: experimental`
Change "reference" to "references" to match new schema 2018-01-27 23:12:19 +00:00			`references:`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`- https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html`
			`- https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx`
			`- https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx`
			`date: 2017/05/15`
docs: modification date in rule 2019-07-17 07:21:35 +00:00			`modified: 2019/07/17`
Added missing tags and some minor improvements 2019-03-05 22:25:49 +00:00			`tags:`
			`- attack.defense_evasion`
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-24 23:09:17 +00:00			`- attack.t1073 # an old one`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1574.002`
author string modified 2019-07-17 04:02:59 +00:00			`author: "Dimitrios Slamaris, @atc_project (fix)"`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`logsource:`
			`product: windows`
win_susp_dhcp_config_failed fixed 2019-07-17 04:01:58 +00:00			`service: system`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`detection:`
			`selection:`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`EventID:`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`- 1031`
			`- 1032`
			`- 1034`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`Source: Microsoft-Windows-DHCP-Server`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`condition: selection`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`falsepositives:`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`- Unknown`
			`level: critical`