Techniques › T1557.003 › AN1291
AN1291 Analytic 1291
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects rogue DHCP activity by monitoring syslog for dhclient messages assigning unauthorized DNS/gateway values. Packet capture or IDS can detect multiple competing DHCP OFFERs from non-authorized servers.</p>
- Detects
- T1557.003 DHCP Spoofing
- Part of
- DET0468 Detect DHCP Spoofing Across Linux, Windows, and macOS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| linux:syslog | suspicious DHCP lease assignment with unexpected DNS or gateway | DC0038 Application Log Content |
| NSM:Flow | Gratuitous or duplicate DHCP OFFER packets from non-legitimate servers | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedDHCPMACs | Expected MAC addresses of DHCP servers on subnet. |
DHCPLeaseChangeThreshold | Number of suspicious DHCP leases before raising an alert. |