# Source: https://docs.datadoghq.com/security/default_rules/def-000-v57.md

---
title: Windows DHCP server loaded CallOut DLL
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Windows DHCP server loaded CallOut DLL
---

# Windows DHCP server loaded CallOut DLL

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0005-defense-evasion](https://attack.mitre.org/tactics/TA0005)Technique:[T1574-hijack-execution-flow](https://attack.mitre.org/techniques/T1574) 
## Goal{% #goal %}

Detects when a DHCP server loads a CallOut DLL, which can be used by attackers to execute malicious code with SYSTEM privileges.

## Strategy{% #strategy %}

This rule monitors Windows Event ID `1033` from the Microsoft-Windows-DHCP-Server provider. The event indicates that a DHCP server has loaded a CallOut DLL, which is a mechanism that allows for custom extension of DHCP server functionality. Loading a CallOut DLL is a rare occurrence in most environments and can be abused by attackers to execute malicious code with elevated privileges as the DHCP service typically runs with SYSTEM privileges. This technique allows an attacker to hijack the execution flow by inserting a malicious DLL that gets loaded by a legitimate process.

## Triage & Response{% #triage--response %}

- Verify if the loaded DLL is expected in your environment and approved by the administrator.
- Analyze the CallOut DLL file for suspicious characteristics including digital signatures, file creation date, and file location.
- Review recent changes to DHCP server configuration that may have enabled the CallOut DLL functionality.
- Check for any related suspicious process activity around the time the DLL was loaded.