kevmap

Techniques › T1557 › T1557.003

T1557.003 DHCP Spoofing

credential access · collection — Linux, Windows, macOS · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
1
Sigma rules tagged attack.t1557.003
0
KEV CVEs mapped here
<p>Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.</p><p>DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients. The typical server-client interaction is as follows:</p><p>1. The client broadcasts a DISCOVER message.</p><p>2. The server responds with an OFFER message, which includes an available network address.</p><p>3. The client broadcasts a REQUEST message, which includes the network address offered.</p><p>4. The server acknowledges with an ACK message and the client receives the network configuration parameters.</p><p>Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers. Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.</p><p>DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a <code>INFORMATION-REQUEST (code 11)</code> message to the <code>All_DHCP_Relay_Agents_and_Servers</code> multicast address. Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.</p><p>Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, Service Exhaustion Flood) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1557.003

Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-20 · logsource: product=windows service=security · b07e58cf-cacc-4135-8473-ccb2eba63dd2
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,. where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.
Techniques: T1557.003

Rules tagged at the parent level (attack.t1557) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Notepad++ Updater DNS Query to Uncommon Domains mediumexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-02 (modified 2026-03-16) · logsource: product=windows category=dns_query · 2074e137-1b73-4e2d-88ba-5a3407dbdce0
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
Techniques: T1195.002T1557
Uncommon File Created by Notepad++ Updater Gup.EXE highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-03 (modified 2026-03-16) · logsource: product=windows category=file_event · 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Techniques: T1195.002T1557
Cisco LDP Authentication Failures lowtest
Author: Tim Brown · 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Techniques: T1078T1110T1557
Cisco BGP Authentication Failures lowtest
Author: Tim Brown · 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Techniques: T1078T1110T1557
Huawei BGP Authentication Failures lowtest
Author: Tim Brown · 2023-01-09 (modified 2023-01-23) · logsource: product=huawei service=bgp · a557ffe6-ac54-43d2-ae69-158027082350
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Techniques: T1078T1110T1557
Juniper BGP Missing MD5 lowtest
Author: Tim Brown · 2023-01-09 (modified 2023-01-23) · logsource: product=juniper service=bgp · a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Techniques: T1078T1110T1557
Suspicious Child Process of Notepad++ Updater - GUP.Exe highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-03 · logsource: product=windows category=process_creation · bb0e87ce-c89f-4857-84fa-095e4483e9cb
Detects suspicious child process creation by the Notepad++ updater process (gup.exe). This could indicate potential exploitation of the updater component to deliver unwanted malware.
Techniques: T1195.002T1557
Potential Suspicious Activity Using SeCEdit mediumtest
Author: Janantha Marasinghe · 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Techniques: T1685.001T1547.001T1505.005T1556.002T1685T1574.007T1564.002T1546.008T1546.007T1547.014T1547.010T1547.002T1557T1082
ISATAP Router Address Was Set mediumexperimental
Author: hamid · 2025-10-19 · logsource: product=windows service=system · d22df9cd-2aee-4089-93c7-9dc4eae77f2c
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Techniques: T1557T1565.002
Azure Sign-In With Axios User Agent lowexperimental
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2026-04-28 · logsource: product=azure service=signinlogs · ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4
Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios", indicating potential use of automated credential harvesting or AiTM phishing infrastructure. Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens. When triaging results, analysts should: - Check the sign-in risk level, MFA status, and conditional access results for signs of bypass. - Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts. - Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.
Techniques: T1557