Windows DHCP Pool Exhaustion Indicating Starvation Attack

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a pattern of lease denials consistent with DHCP starvation, where an attacker requests leases until the pool is empty so that legitimate devices cannot obtain an address. It is typically a precursor to a rogue DHCP server taking over address assignment and redirecting traffic. Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASE_DENIED' | duration 10m | groupby macaddress | select macaddress, count(*) as cnt | having cnt > 20