DHCP Spoofing
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The observable is a DHCP packet on the wire — an OFFER/ACK from an unauthorized server carrying attacker-controlled router and DNS options — and none of the three log sources in this brief carries a DHCP packet, the offering server's MAC or IP, or the option values it handed out. AN1290's only Sigma-expressible leg is windows/system with EventIDs 1341, 1342, 1020 and 1063. Those are Microsoft DHCP Server service events, which means three things that each kill the rule on their own: they are written by the legitimate DHCP server about its own state (scope utilisation and its own Active Directory authorisation), so a rogue server planted on a client subnet writes nothing into them; they exist only on hosts holding the Windows DHCP Server role, not on the victim endpoints where the redirection actually lands; and with no field beyond EventID to qualify on, the rule reduces to 'match four DH […]
What the technique is
Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients. The typical server-client interaction is as follows: 1. The client broadcasts a DISCOVER message. 2. The server responds with an OFFER message, which includes an available network address. 3. The client broadcasts a REQUEST message, which includes the network address offered. 4. The server acknowledges with an ACK message and the client receives the network configuration parameters. Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1290
Detects rogue DHCP server activity and anomalous DHCP OFFER/ACK messages assigning unexpected DNS or gateway values. Detection correlates DHCP server role changes, DHCP exhaustion warnings, and sudden network configuration changes across endpoints.
- AN1291
Detects rogue DHCP activity by monitoring syslog for dhclient messages assigning unauthorized DNS/gateway values. Packet capture or IDS can detect multiple competing DHCP OFFERs from non-authorized servers.
- AN1292
Detects DHCP spoofing by monitoring unified logs for unexpected DHCP ACK/OFFER parameters and correlating with packet captures for multiple DHCP servers. Behavioral emphasis is on inconsistent DNS and gateway assignments that redirect traffic.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.