Vendor: Microsoft

April 15, 2026 · View on GitHub

Product: Microsoft DHCP Log

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
94431228
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessapp-activity
microsoft-dhcpsyslog-csv-dns-record-modify-fail-updatefail
microsoft-evdhcpserver-csv-dns-record-delete-fail-notdeleted
microsoft-windows-csv-network-notification-success-dnsrenew-1
microsoft-windows-csv-network-notification-success-dnsrenew
microsoft-evdhcpserver-csv-app-notification-success-deleted
microsoft-dhcpsyslog-csv-dns-record-modify-update
T1078 - Valid Accounts
T1133 - External Remote Services
  • 12 Rules
  • 4 Models
Account Manipulationapp-activity
microsoft-dhcpsyslog-csv-dns-record-modify-fail-updatefail
microsoft-evdhcpserver-csv-dns-record-delete-fail-notdeleted
microsoft-windows-csv-network-notification-success-dnsrenew-1
microsoft-windows-csv-network-notification-success-dnsrenew
microsoft-evdhcpserver-csv-app-notification-success-deleted
microsoft-dhcpsyslog-csv-dns-record-modify-update
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Application Layer Protocol

Proxy