[IC] - Detecting non-familiar DHCPDomains configured in our devices
On environments managing sensible or critical information, I am not really happy when their local device configuration are modified and their network rely on airports, hotels, or the nearest coffee shop's Wi-Fi. This Query review if the TCPIP register is modified and it DHCP Domain is managed by a non-trusted/known network. It would help to restrict their access to enterprise data until be 100% sure they are using a VPN or back to enterprise DHCP Domain.
Microsoft Sentinel (KQL)
