Windows DHCP Server Loaded Callout DLL via Registry
Flags DHCP Server events where a registry-specified callout DLL is loaded (Event ID 1033), indicating potential persistence or execution.
- Product
- windows
- Service
- system
- Author
- Dimitrios Slamaris (SigmaHQ), DRL 1.1
- Published
- 2017-05-15
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies a Windows DHCP Server event where a specified callout DLL is loaded, based on registry-related configuration. Attackers may use callout DLL loading in the DHCP Server context to persist, execute, or maintain stealthy network-related behavior. Detection relies on Windows System telemetry, specifically an EventID 1033 from the Microsoft-Windows-DHCP-Server provider.
Reporting behind it
- blog.3or.dehttps://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
- technet.microsoft.comhttps://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
- msdn.microsoft.comhttps://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DHCP Server Loaded Callout DLL via Registry
id: e5ca3c51-e2ee-44c3-84b3-e68b02ba4b29
status: test
description: This rule identifies a Windows DHCP Server event where a specified callout DLL is loaded, based on registry-related configuration. Attackers may use callout DLL loading in the DHCP Server context to persist, execute, or maintain stealthy network-related behavior. Detection relies on Windows System telemetry, specifically an EventID 1033 from the Microsoft-Windows-DHCP-Server provider.
references:
- https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
- https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
- https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml
author: Dimitrios Slamaris, Huntrule Team
date: 2017-05-15
modified: 2022-12-25
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
product: windows
service: system
detection:
selection:
EventID: 1033
Provider_Name: Microsoft-Windows-DHCP-Server
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 13fc89a9-971e-4ca6-b9dc-aa53a445bf40
type: derived