CVE-2026-44815 Windows DHCP Client RCE - Anomalous svchost/DHCP Child Process or Crash

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

This rule monitors for suspicious activity originating from the DHCP Client service process (svchost.exe running with 'Dhcp' in the command line). It detects unauthorized child processes (such as cmd.exe or powershell.exe), unexpected child processes that deviate from established baselines, service crashes potentially indicative of exploitation, and anomalous network connections to non-standard DHCP ports or external IP addresses.