SigmaHQ/rules/windows/builtin/win_susp_dhcp_config_failed.yml

title: DHCP Server Error Failed Loading the CallOut DLL
description: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded
status: experimental
references:
    - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
    - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
    - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
date: 2017/05/15
tags:
    - attack.defense_evasion
    - attack.t1073
author: "Dimitrios Slamaris, @atc_project (fix)"
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 
            - 1031
            - 1032
            - 1034
        Source: Microsoft-Windows-DHCP-Server            
    condition: selection
falsepositives: 
    - Unknown
level: critical
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`title: DHCP Server Error Failed Loading the CallOut DLL`
			`description: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded`
			`status: experimental`
Change "reference" to "references" to match new schema 2018-01-27 23:12:19 +00:00			`references:`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`- https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html`
			`- https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx`
			`- https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx`
			`date: 2017/05/15`
Added missing tags and some minor improvements 2019-03-05 22:25:49 +00:00			`tags:`
			`- attack.defense_evasion`
			`- attack.t1073`
author string modified 2019-07-17 04:02:59 +00:00			`author: "Dimitrios Slamaris, @atc_project (fix)"`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`logsource:`
			`product: windows`
win_susp_dhcp_config_failed fixed 2019-07-17 04:01:58 +00:00			`service: system`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`detection:`
			`selection:`
Rule: limiting rule to DHCP log 2019-02-05 13:33:16 +00:00			`EventID:`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`- 1031`
			`- 1032`
			`- 1034`
prevent EventID collision for dhcp This prevents EventID collision for this rule with other sources/logs that share the same EventIDs. specifically a lot with Microsoft-Windows-Security-SPP 2019-07-16 19:30:52 +00:00			`Source: Microsoft-Windows-DHCP-Server`
1) Add Windows DHCP Server Callout DLL rules: Sysmon, failed loading and successfull loading 2) correct typo in dns server rule 2017-05-15 18:58:31 +00:00			`condition: selection`
			`falsepositives:`
			`- Unknown`
			`level: critical`