T1557.003 — DHCP Spoofing

Tactics: Credential Access, Collection · Platforms: Linux, Windows, macOS

Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications,…

Sub-technique of Adversary-in-the-Middle (T1557).

Sigma detection rules (3)

T1557.003 Adversary-in-the-Middle: DHCP Spoofing

title: "T1557.003 Adversary-in-the-Middle: DHCP Spoofing"
id: 833bf4ac-f754-4563-9d79-b9b62ff9fc64
description: 'Detects unexpected changes to the DHCP server or default gateway recorded in a network interface''s Tcpip parameters registry key, a Windows-observable proxy for a rogue/spoofed DHCP server altering the host''s network configuration. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: AuthorizedDHCPServers, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1557/003
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557.003

logsource:
  category: registry_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 13
    TargetObject|contains: '\Tcpip\Parameters\Interfaces\'

  selection_field:
    TargetObject|endswith:
      - '\DhcpServer'
      - '\DhcpDefaultGateway'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_field and not filter_system_account

falsepositives:
  - Legitimate DHCP lease renewal when roaming between authorized networks (e.g. laptops, VPN reconnects).
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1557.003 Adversary-in-the-Middle: DHCP Spoofing

title: "T1557.003 Adversary-in-the-Middle: DHCP Spoofing"
id: 40b56d97-ddce-4349-8831-09a666795a82
description: 'Detect DHCP Spoofing Across Linux, Windows, and macOS. (Retargeted to the process_creation and syscall auditd telemetry that actually captures this techniques behavior; see logsource below.) Now also flags any non-system process performing a bind() to UDP port 67, not just a rogue daemon binary launched from /tmp or /dev/shm. Tune using: AllowedDHCPMACs, DHCPLeaseChangeThreshold, KnownDHCPDaemonPaths.'
references:
  - https://attack.mitre.org/techniques/T1557/003
author: Shahrukh Khan
date: 2026-03-15
license: MIT
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557.003

logsource:
  product: linux
  service: auditd

detection:
  selection_daemon_tmp:
    type: EXECVE
    a0|endswith:
      - '/dhcpd'
      - '/dnsmasq'
    exe|startswith:
      - '/tmp/'
      - '/dev/shm/'
  selection_bind_dhcp_port:
    type: SYSCALL
    syscall: bind
    success: 'yes'
    saddr|startswith: '02000043'
  filter_known_dhcp_daemons:
    exe:
      - '/usr/sbin/dhcpd'
      - '/usr/sbin/dnsmasq'
      - '/usr/sbin/kea-dhcp4'
      - '/usr/lib/systemd/systemd-networkd'
      - '/usr/sbin/NetworkManager'

  condition: selection_daemon_tmp or (selection_bind_dhcp_port and not filter_known_dhcp_daemons)

falsepositives:
  - DHCP spoofing is fundamentally a network-broadcast event; auditd has no native DHCP lease telemetry, so the daemon-path branch only flags a rogue DHCP binary launched from a non-standard path.
  - The bind-to-port-67 branch can false-positive on legitimate but unlisted DHCP relay/server software not present in the known-daemon exclusion list; add any additional approved DHCP server paths to filter_known_dhcp_daemons.

level: medium

T1557.003 Adversary-in-the-Middle: DHCP Spoofing

title: "T1557.003 Adversary-in-the-Middle: DHCP Spoofing"
id: def2f7db-35be-47cc-99d3-dac1b8db040f
description: 'Detect DHCP Spoofing Across Linux, Windows, and macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BaselineDNS, AlertSensitivity.'
references:
  - https://attack.mitre.org/techniques/T1557/003
author: Shahrukh Khan
date: 2026-03-03
license: MIT
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bootpd'
      - '/dhcpd'

  condition: selection

falsepositives:
  - Unified log rarely captures DHCP server processes on a macOS endpoint since it is not a typical DHCP server platform; any occurrence is unusual but this rule cannot see the actual spoofed lease content.

level: high

Related sub-techniques

Explore