DHCP Server Loaded Malicious Callout DLL

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

This rule detects when a DHCP server loads a specified Callout DLL, which can be abused for persistence, privilege escalation, or defense evasion. Adversaries might inject malicious DLLs into legitimate processes like the DHCP server to maintain access or elevate privileges on a system.