Windows DHCP Lease Requested by Unknown MAC Address
Detects a DHCP lease request from a MAC address absent from the asset inventory. DHCP sees every device that joins the network, including those with no agent, no domain membership and no EDR — which makes it the only reliable place to catch unmanaged hardware appearing on the wire. Requires an inventory of known MAC addresses to compare against; without one this detection has nothing to anchor to. Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASED' | groupby macaddress, srcip, user
Sigma
