Windows DHCP Server Callout DLL Load Failures (Event IDs 1031/1032/1034)

title: Windows DHCP Server Callout DLL Load Failures (Event IDs 1031/1032/1034)
id: a0773047-5419-48a6-9a2f-5c0e10d226ae
status: test
description: This rule identifies DHCP Server errors where a configured Callout DLL could not be loaded, as indicated by Microsoft-Windows-DHCP-Server events with IDs 1031, 1032, or 1034. Failing to load a callout DLL can reflect attempted or misconfigured callout-based behavior that attackers may use for persistence or execution within the DHCP server’s processing path. The detection relies on Windows System telemetry from the Microsoft-Windows-DHCP-Server provider.
references:
  - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config_failed.yml
author: Dimitrios Slamaris, @atc_project (fix), Huntrule Team
date: 2017-05-15
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID:
      - 1031
      - 1032
      - 1034
    Provider_Name: Microsoft-Windows-DHCP-Server
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 75edd3fd-7146-48e5-9848-3013d7f0282c
    type: derived