1. Home
  2. ATT&CK Techniques
  3. T1557.003 DHCP Spoofing

T1557.003 DHCP Spoofing

Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.

DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows:

  1. The client broadcasts a DISCOVER message.

  2. The server responds with an OFFER message, which includes an available network address.

  3. The client broadcasts a REQUEST message, which includes the network address offered.

  4. The server acknowledges with an ACK message and the client receives the network configuration parameters.

Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.

DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a <code>INFORMATION-REQUEST (code 11)</code> message to the <code>All_DHCP_Relay_Agents_and_Servers</code> multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.

Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, Service Exhaustion Flood) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.AE-02.01 Event analysis and detection Mitigates T1557.003 DHCP Spoofing
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
    PR.IR-01.02 Network device configurations Mitigates T1557.003 DHCP Spoofing
    Comments
    This diagnostic statement provides protection through secure network device configurations (e.g., firewall rules, ports, and protocols) aligned to security baselines. Using network appliances to block or filter network traffic that is not necessary within the environment can prevent leveraging for AiTM conditions.
    References
      DE.CM-01.01 Intrusion detection and prevention Mitigates T1557.003 DHCP Spoofing
      Comments
      The use of network intrusion detection and prevention systems can identify and possibly bock traffic patterns, indicative of AiTM activity. If so, these patterns can be mitigated at the network level.
      References
        PR.IR-01.01 Network segmentation Mitigates T1557.003 DHCP Spoofing
        Comments
        This diagnostic statement is for the implementation of network segmentation which helps prevent access to critical systems and sensitive information. Isolate infrastructure components and blocking network traffic that is not necessary can mitigate, or at least alleviate, the scope of AiTM activity.
        References
          PR.IR-04.01 Utilization monitoring Mitigates T1557.003 DHCP Spoofing
          Comments
          This diagnostic statement describes how the organization establishes and manages baseline measures of network activity. Supported by network monitoring tools and other controls to detect events and identify incidents. Mitigating mechanisms may include: Data Loss Prevention (DLP); Filtering Network Traffic; Limit Network Traffic; Network Intrusion Prevention Systems (NIPS); and Network Segmentation for these type of network-based techniques.
          References
            PR.IR-01.03 Network communications integrity and availability Mitigates T1557.003 DHCP Spoofing
            Comments
            This diagnostic statement protects against DHCP Spoofing through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
            References
              PR.PS-01.08 End-user device protection Mitigates T1557.003 DHCP Spoofing
              Comments
              This diagnostic statement protects against DHCP Spoofing through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
              References

                NIST 800-53 Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                CA-07 Continuous Monitoring mitigates T1557.003 DHCP Spoofing
                CM-06 Configuration Settings mitigates T1557.003 DHCP Spoofing
                CM-08 System Component Inventory mitigates T1557.003 DHCP Spoofing
                SC-23 Session Authenticity mitigates T1557.003 DHCP Spoofing
                SC-46 Cross Domain Policy Enforcement mitigates T1557.003 DHCP Spoofing
                SC-08 Transmission Confidentiality and Integrity mitigates T1557.003 DHCP Spoofing
                SI-10 Information Input Validation mitigates T1557.003 DHCP Spoofing
                SI-15 Information Output Filtering mitigates T1557.003 DHCP Spoofing
                SI-03 Malicious Code Protection mitigates T1557.003 DHCP Spoofing
                CM-02 Baseline Configuration mitigates T1557.003 DHCP Spoofing
                CM-07 Least Functionality mitigates T1557.003 DHCP Spoofing
                SI-04 System Monitoring mitigates T1557.003 DHCP Spoofing
                AC-03 Access Enforcement mitigates T1557.003 DHCP Spoofing
                AC-04 Information Flow Enforcement mitigates T1557.003 DHCP Spoofing
                SC-07 Boundary Protection mitigates T1557.003 DHCP Spoofing

                VERIS Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                action.malware.variety.AiTM Man-in-the-middle attack. Child of 'Exploit vuln'. related-to T1557.003 DHCP Spoofing

                Azure Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                azure_firewall Azure Firewall technique_scores T1557.003 DHCP Spoofing
                Comments
                This control can detect DHCP spoofing by monitoring network traffic.
                References
                1. https://learn.microsoft.com/en-us/azure/firewall/overview
                azure_firewall Azure Firewall technique_scores T1557.003 DHCP Spoofing
                Comments
                This control can protect against DHCP spoofing by restricting DHCP traffic to trusted DHCP servers.
                References
                1. https://learn.microsoft.com/en-us/azure/firewall/overview

                GCP Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                cloud_ngfw Cloud Next-Generation Firewall (NGFW)_ technique_scores T1557.003 DHCP Spoofing
                Comments
                Cloud NGFW can be configured with firewall rules to mitigate DHCP Spoofing.
                References
                1. ['https://cloud.google.com/firewalls']

                AWS Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                amazon_virtual_private_cloud Amazon Virtual Private Cloud technique_scores T1557.003 DHCP Spoofing