Windows DHCP Single MAC Cycling Through Multiple Leases

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects one MAC address obtaining an unusual number of distinct leases. Legitimate devices hold a lease and renew it. Rapid cycling suggests either MAC spoofing or a device deliberately churning addresses to frustrate tracking and evade controls bound to an IP. Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASED' | duration 1h | groupby macaddress | select macaddress, distinct_count(srcip) | having distinct_count_col1 > 5