{"id":"b07e58cf-cacc-4135-8473-ccb2eba63dd2","title":"Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation","description":"Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob\nmatching the pattern \"1UWhRCAAAAA...BAAAA\". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,\ncommonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to\nattacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.\nwhere adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.\nPlease investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-20","modified":"","tags":["attack.collection","attack.credential-access","attack.t1557.003","attack.persistence","attack.privilege-escalation"],"technique_ids":["T1557.003"],"logsource":{"product":"windows","service":"security","definition":"By default these events are not logged by default for MicrosoftDNS objects in Active Directory.\nTo enable detection, configure an AuditRule on the DNS object container with the \"CreateChild\" permission for the \"Everyone\" principal.\nThis can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule).\n"},"falsepositives":["Unknown"],"references":["https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html","https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025"],"source_path":"rules/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml","source_sha256":"0ef61cfa37bd698b5c7db966bbb146420026443c20731702e2fc97008b4e4619","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation\nid: b07e58cf-cacc-4135-8473-ccb2eba63dd2\nrelated:\n    - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing\n      type: similar\n    - id: 5588576c-5898-4fac-bcdd-7475a60e8f43 # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing - Network\n      type: similar\n    - id: 0ed99dda-6a35-11ef-8c99-0242ac120002 # Kerberos Coercion Via DNS SPN Spoofing Attempt\n      type: similar\nstatus: experimental\ndescription: |\n    Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob\n    matching the pattern \"1UWhRCAAAAA...BAAAA\". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,\n    commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to\n    attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.\n    where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.\n    Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.\nreferences:\n    - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html\n    - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-06-20\ntags:\n    - attack.collection\n    - attack.credential-access\n    - attack.t1557.003\n    - attack.persistence\n    - attack.privilege-escalation\nlogsource:\n    product: windows\n    service: security\n    definition: |\n      By default these events are not logged by default for MicrosoftDNS objects in Active Directory.\n      To enable detection, configure an AuditRule on the DNS object container with the \"CreateChild\" permission for the \"Everyone\" principal.\n      This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule).\ndetection:\n    selection_directory_service_changes:\n        EventID:\n            - 5136\n            - 5137\n        ObjectClass: 'dnsNode'\n        ObjectDN|contains|all: # ObjectDN\">DC=foo-11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=domain.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com</Data>\n            - 'UWhRCA'\n            - 'BAAAA'\n            - 'CN=MicrosoftDNS'\n    selection_directory_service_access:\n        EventID: 4662\n        AdditionalInfo|contains|all: # AdditionalInfo\">DC=foo-11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=domain.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com</Data>\n            - 'UWhRCA'\n            - 'BAAAA'\n            - 'CN=MicrosoftDNS'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1557.003","id":"T1557.003","name":"DHCP Spoofing","page":"techniques/enterprise/T1557.003/"}],"data_path":"data/detection-rules/b07e58cf-cacc-4135-8473-ccb2eba63dd2.json","kind":"sigma"}