CVE-2020-13529

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "DhcpRequest" or ActionType == "DhcpAck"
| where InitiatingProcessFileName == "systemd-networkd" // Assuming systemd-networkd is the DHCP client
| summarize DhcpEvents = make_list(ActionType) by DeviceName, DeviceIp, bin(Timestamp, 1m)
| where array_length(DhcpEvents) > 1 and DhcpEvents has "DhcpRequest" and DhcpEvents has "DhcpAck"
// Further refinement needed to detect FORCERENEW and spoofed ACK based on packet content if available in logs

Splunk SPL

(sourcetype=dhcp OR sourcetype=syslog) (systemd OR networkd) (FORCERENEW OR "DHCP ACK")
| transaction host startswith="FORCERENEW" endswith="DHCP ACK" maxpause=1m
| where isnotnull(host)

Sigma

title: Systemd DHCP Spoofing Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential DHCP ACK spoofing attacks against systemd DHCP client using FORCERENEW packets.
author: SecBoard
date: 2023/10/27
logsource:
  product: linux
  service: systemd
detection:
  selection_forcerenew:
    EventID: "DHCP_FORCERENEW"
    # Add more specific fields if available in systemd logs for FORCERENEW
  selection_ack:
    EventID: "DHCP_ACK"
    # Add more specific fields if available in systemd logs for spoofed ACK
  condition: selection_forcerenew and selection_ack
falsepositives:
  - Legitimate DHCP reconfigurations (requires careful tuning)
level: medium

Elastic ES|QL

FROM logs-systemd-*
| WHERE message : "FORCERENEW" OR message : "DHCP ACK"
| WHERE process.name : "systemd-networkd"
| TRANSACTION BY host.name
  START (message : "FORCERENEW")
  END (message : "DHCP ACK")
  MAX_SPAN 1m
| WHERE transaction.duration > 0