Windows DHCP Server Loads Callout DLL via Registry (Event ID 1033)

title: Windows DHCP Server Loads Callout DLL via Registry (Event ID 1033)
id: e5ca3c51-e2ee-44c3-84b3-e68b02ba4b29
status: test
description: This rule identifies a Windows DHCP Server that reports loading a specified Callout DLL based on registry information. Attackers may abuse DHCP callout mechanisms to persist or execute code within the context of the DHCP service while remaining stealthy. The detection relies on System logs containing Microsoft-Windows-DHCP-Server Event ID 1033 events and the event fields that indicate the Callout DLL loaded.
references:
  - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml
author: Dimitrios Slamaris, Huntrule Team
date: 2017-05-15
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 1033
    Provider_Name: Microsoft-Windows-DHCP-Server
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 13fc89a9-971e-4ca6-b9dc-aa53a445bf40
    type: derived