TA0006 · CREDENTIAL ACCESS
DHCP Spoofing
Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.
Detect it with
Monitor network traffic for suspicious/malicious behavior involving DHCP, such as changes in DNS and/or gateway parameters.
Why it matters on shift
DHCP Spoofing is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context