Merge pull request #32 from dim0x69/master

Add Windows DHCP Server Callout DLL rules

rules/windows/builtin/win_susp_dhcp_config.yml

@@ -0,0 +1,18 @@
+title: DHCP Server loaded the CallOut DLL
+status: experimental
+description: This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded
+reference:
+    - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
+    - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
+    - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
+date: 2017/05/15
+author: Dimitrios Slamaris
+logsource:
+    product: windows
+    service: system
+detection:
+    EventLog: System
+    EventID: 1033
+falsepositives: 
+    - Unknown
+level: critical

rules/windows/builtin/win_susp_dhcp_config_failed.yml

@@ -0,0 +1,23 @@
+title: DHCP Server Error Failed Loading the CallOut DLL
+description: This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded
+status: experimental
+reference:
+    - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
+    - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
+    - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
+date: 2017/05/15
+author: Dimitrios Slamaris
+logsource:
+    product: windows
+    service: system
+detection:
+    selection:
+        - EventLog: System
+          EventID: 
+            - 1031
+            - 1032
+            - 1034
+    condition: selection
+falsepositives: 
+    - Unknown
+level: critical

rules/windows/sysmon/sysmon_dhcp_calloutdll.yml

@@ -0,0 +1,22 @@
+title: DHCP Callout DLL installation
+status: experimental
+description: Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)
+reference: 
+    - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
+    - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
+    - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
+date: 2017/05/15
+author: Dimitrios Slamaris
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection:
+        EventID: 13
+        TargetObject: 
+            - '*\Services\DHCPServer\Parameters\CalloutDlls'
+            - '*\Services\DHCPServer\Parameters\CalloutEnabled'
+    condition: selection
+falsepositives:
+    - unknown
+level: high