Windows Registry: DHCP Server Callout DLL and Enable Parameters Installation
Alerts on registry changes enabling and configuring DHCP Server callout DLLs via CalloutDlls and CalloutEnabled.
- Product
- windows
- Category
- registry_set
- Author
- Dimitrios Slamaris (SigmaHQ), DRL 1.1
- Published
- 2017-05-15
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when registry entries for the DHCP Server callout DLLs and the corresponding enablement flag are created or set. Attackers can use these parameters to have the DHCP server load and execute attacker-controlled code, typically requiring a DHCP service restart for changes to take effect. The detection relies on registry-set telemetry matching TargetObject paths ending in CalloutDlls and CalloutEnabled under the DHCPServer parameters.
Reporting behind it
- blog.3or.dehttps://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
- technet.microsoft.comhttps://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
- msdn.microsoft.comhttps://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: DHCP Server Callout DLL and Enable Parameters Installation"
id: 37d1df41-9716-476c-b5b9-1b3c58907c46
status: test
description: This rule identifies when registry entries for the DHCP Server callout DLLs and the corresponding enablement flag are created or set. Attackers can use these parameters to have the DHCP server load and execute attacker-controlled code, typically requiring a DHCP service restart for changes to take effect. The detection relies on registry-set telemetry matching TargetObject paths ending in CalloutDlls and CalloutEnabled under the DHCPServer parameters.
references:
- https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
- https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
- https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml
author: Dimitrios Slamaris, Huntrule Team
date: 2017-05-15
modified: 2023-08-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.defense-impairment
- attack.t1574.001
- attack.t1112
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith:
- \Services\DHCPServer\Parameters\CalloutDlls
- \Services\DHCPServer\Parameters\CalloutEnabled
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 9d3436ef-9476-4c43-acca-90ce06bdf33a
type: derived