Windows Registry: DHCP Server Callout DLL and Enable Parameters Installation

title: "Windows Registry: DHCP Server Callout DLL and Enable Parameters Installation"
id: 37d1df41-9716-476c-b5b9-1b3c58907c46
status: test
description: This rule identifies when registry entries for the DHCP Server callout DLLs and the corresponding enablement flag are created or set. Attackers can use these parameters to have the DHCP server load and execute attacker-controlled code, typically requiring a DHCP service restart for changes to take effect. The detection relies on registry-set telemetry matching TargetObject paths ending in CalloutDlls and CalloutEnabled under the DHCPServer parameters.
references:
  - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml
author: Dimitrios Slamaris, Huntrule Team
date: 2017-05-15
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.defense-impairment
  - attack.t1574.001
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith:
      - \Services\DHCPServer\Parameters\CalloutDlls
      - \Services\DHCPServer\Parameters\CalloutEnabled
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9d3436ef-9476-4c43-acca-90ce06bdf33a
    type: derived