AN1290
Analytic 1290
Windows
Detects rogue DHCP server activity and anomalous DHCP OFFER/ACK messages assigning unexpected DNS or gateway values. Detection correlates DHCP server role changes, DHCP exhaustion warnings, and sudden network configuration changes across endpoints.
WinEventLog:System
EventCode=1341, 1342, 1020, 1063
NSM:Flow
DHCP OFFER or ACK with unauthorized DNS/gateway parameters
[AuthorizedDHCPServers]
List of known DHCP servers; unexpected sources are suspicious.
[TimeWindow]
Interval to correlate DHCP OFFER/ACK anomalies with subsequent misconfigurations.
AN1291
Analytic 1291
Linux
Detects rogue DHCP activity by monitoring syslog for dhclient messages assigning unauthorized DNS/gateway values. Packet capture or IDS can detect multiple competing DHCP OFFERs from non-authorized servers.
linux:syslog
suspicious DHCP lease assignment with unexpected DNS or gateway
NSM:Flow
Gratuitous or duplicate DHCP OFFER packets from non-legitimate servers
[AllowedDHCPMACs]
Expected MAC addresses of DHCP servers on subnet.
[DHCPLeaseChangeThreshold]
Number of suspicious DHCP leases before raising an alert.
AN1292
Analytic 1292
macOS
Detects DHCP spoofing by monitoring unified logs for unexpected DHCP ACK/OFFER parameters and correlating with packet captures for multiple DHCP servers. Behavioral emphasis is on inconsistent DNS and gateway assignments that redirect traffic.
macos:unifiedlog
new DHCP configuration with anomalous DNS or router values
NSM:Flow
Multiple DHCP OFFER responses for a single DISCOVER
[BaselineDNS]
Expected DNS server list; deviations may indicate spoofing.
[AlertSensitivity]
Threshold for number of anomalous DHCP responses before alerting.