Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0468 — Detect DHCP Spoofing Across Linux, Windows, and macOS
DET0468

Detect DHCP Spoofing Across Linux, Windows, and macOS

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1290 Analytic 1290
Windows

Detects rogue DHCP server activity and anomalous DHCP OFFER/ACK messages assigning unexpected DNS or gateway values. Detection correlates DHCP server role changes, DHCP exhaustion warnings, and sudden network configuration changes across endpoints.

WinEventLog:System EventCode=1341, 1342, 1020, 1063 NSM:Flow DHCP OFFER or ACK with unauthorized DNS/gateway parameters
[AuthorizedDHCPServers] List of known DHCP servers; unexpected sources are suspicious.
[TimeWindow] Interval to correlate DHCP OFFER/ACK anomalies with subsequent misconfigurations.
AN1291 Analytic 1291
Linux

Detects rogue DHCP activity by monitoring syslog for dhclient messages assigning unauthorized DNS/gateway values. Packet capture or IDS can detect multiple competing DHCP OFFERs from non-authorized servers.

linux:syslog suspicious DHCP lease assignment with unexpected DNS or gateway NSM:Flow Gratuitous or duplicate DHCP OFFER packets from non-legitimate servers
[AllowedDHCPMACs] Expected MAC addresses of DHCP servers on subnet.
[DHCPLeaseChangeThreshold] Number of suspicious DHCP leases before raising an alert.
AN1292 Analytic 1292
macOS

Detects DHCP spoofing by monitoring unified logs for unexpected DHCP ACK/OFFER parameters and correlating with packet captures for multiple DHCP servers. Behavioral emphasis is on inconsistent DNS and gateway assignments that redirect traffic.

macos:unifiedlog new DHCP configuration with anomalous DNS or router values NSM:Flow Multiple DHCP OFFER responses for a single DISCOVER
[BaselineDNS] Expected DNS server list; deviations may indicate spoofing.
[AlertSensitivity] Threshold for number of anomalous DHCP responses before alerting.

Detected Techniques

1

Credential Access (1)

Details

MITRE ID
DET0468
STIX ID
x-mitre-detection-strategy--9f227978-8d56-406f-9d50-ef10aae1bf77
Analytics
3
Techniques Detected
1
By Tactic
Credential Access
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.