Windows DHCP Repeated Lease Denials From Single MAC
Detects repeated lease denials for one MAC address. Denials occur when a device is refused an address — commonly because it is not permitted on the segment — so a device persistently retrying is attempting to join a network it has been excluded from. Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASE_DENIED' | duration 1h | groupby macaddress, resultcode
Sigma
