Windows DHCP Server Loaded Callout DLL via Registry

Flags DHCP Server events where a registry-specified callout DLL is loaded (Event ID 1033), indicating potential persistence or execution.

FreeReviewedSigma · High · v2

Product: windows
Service: system
Author: Dimitrios Slamaris (SigmaHQ), DRL 1.1
Published: 2017-05-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies a Windows DHCP Server event where a specified callout DLL is loaded, based on registry-related configuration. Attackers may use callout DLL loading in the DHCP Server context to persist, execute, or maintain stealthy network-related behavior. Detection relies on Windows System telemetry, specifically an EventID 1033 from the Microsoft-Windows-DHCP-Server provider.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

Suspicious msimg32.dll Loaded from Non-System Directory

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Windows DHCP Server Loaded Callout DLL via Registry

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dhcp-server-loads-callout-dll-via-registry-event-id-1033-13fc89a9

title: Windows DHCP Server Loaded Callout DLL via Registry
id: e5ca3c51-e2ee-44c3-84b3-e68b02ba4b29
status: test
description: This rule identifies a Windows DHCP Server event where a specified callout DLL is loaded, based on registry-related configuration. Attackers may use callout DLL loading in the DHCP Server context to persist, execute, or maintain stealthy network-related behavior. Detection relies on Windows System telemetry, specifically an EventID 1033 from the Microsoft-Windows-DHCP-Server provider.
references:
  - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml
author: Dimitrios Slamaris, Huntrule Team
date: 2017-05-15
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 1033
    Provider_Name: Microsoft-Windows-DHCP-Server
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 13fc89a9-971e-4ca6-b9dc-aa53a445bf40
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL