Windows DHCP DNS Update Requested for Host Outside Inventory

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a DHCP-driven DNS update for a hostname not present in the asset inventory. Dynamic DNS registration lets a device choose the name under which it is reachable, and an attacker can use that to impersonate a service or make a rogue host appear legitimate to anything resolving by name. Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=dhcp where sourcename='WIN-DHCP' and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED') | groupby macaddress, srcip, user, resultcode