Detect DHCP Spoofing in Google Chronicle

rule t1557_003_dhcp_spoofing {
  meta:
    author = "Detection Engineering - Argus"
    description = "Detects DHCP spoofing (T1557.003) via unauthorized port 67 binding, known DHCP attack tool execution, script interpreters with DHCP keywords, and registry DNS config modification via rogue DHCP push"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1557.003"
    severity = "HIGH"
    confidence = "HIGH"
    platform = "Windows, Linux"
    version = "1.0"

  events:
    (
      /* Branch 1: Unauthorized process binding to UDP port 67 */
      (
        $e.metadata.event_type = "NETWORK_CONNECTION" and
        ($e.target.port = 67 or $e.principal.port = 67) and
        $e.network.ip_protocol = "UDP" and
        not re.regex($e.principal.process.file.full_path, `(?i)[/\\]svchost\.exe$`) and
        $e.principal.process.file.full_path != "System"
      )
      or
      /* Branch 2a: Known DHCP attack tool — process name match */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.file.full_path, `(?i)(yersinia|dhcpig|gobbler|dhcpstarv|ettercap|bettercap|mitm6|dhcp6)`)
      )
      or
      /* Branch 2b: DHCP attack tool keyword in command line */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        not re.regex($e.target.process.file.full_path, `(?i)(yersinia|dhcpig|gobbler|dhcpstarv|ettercap|bettercap|mitm6|dhcp6)`) and
        re.regex($e.target.process.command_line, `(?i)(yersinia|dhcpig|gobbler|dhcpstarv|ettercap|bettercap|mitm6|dhcp6)`)
      )
      or
      /* Branch 2c: Script interpreter invoking DHCP attack libraries or keywords */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.target.process.file.full_path, `(?i)[/\\](python[23]?|ruby|perl|bash|sh|pwsh|powershell)(\.exe)?$`) and
        re.regex($e.target.process.command_line, `(?i)(dhcp|bootp|rogue.*dhcp|dhcp.*spoof|mitm6|dhcp6|dhcpstarv|dhcpig)`)
      )
      or
      /* Branch 3: Registry DNS/gateway config modified by non-system process (DHCP-pushed settings) */
      (
        $e.metadata.event_type = "REGISTRY_MODIFICATION" and
        re.regex($e.target.registry.registry_key, `(?i)Tcpip\\Parameters\\Interfaces`) and
        re.regex($e.target.registry.registry_value_name, `(?i)^(DhcpNameServer|NameServer|DhcpDefaultGateway|DhcpSubnetMaskOpt)$`) and
        not re.regex($e.principal.process.file.full_path, `(?i)[/\\](svchost|lsass)\.exe$`) and
        $e.principal.process.file.full_path != "System"
      )
    )

  condition:
    $e
}