Hide Navigation Hide TOC

DHCP Callout DLL Installation (9d3436ef-9476-4c43-acca-90ce06bdf33a)

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4)	Attack Pattern	DHCP Callout DLL Installation (9d3436ef-9476-4c43-acca-90ce06bdf33a)	Sigma-Rules	1
DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34)	Attack Pattern	DHCP Callout DLL Installation (9d3436ef-9476-4c43-acca-90ce06bdf33a)	Sigma-Rules	1
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34)	Attack Pattern	2