DHCP Server Error Failed Loading the CallOut DLL

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•19

This rule detects a DHCP server error where a specified Callout DLL, configured in the registry, could not be loaded. This event can indicate an attempt to inject a malicious DLL into the DHCP server process for persistence, privilege escalation, or defense evasion.