{"id":"e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c","title":"Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing","description":"Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.\nThe pattern \"1UWhRCAAAAA..BAAAA\" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.\nAttackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.\nIt is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records\nto spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-20","modified":"","tags":["attack.collection","attack.credential-access","attack.persistence","attack.privilege-escalation","attack.t1557.001","attack.t1187"],"technique_ids":["T1187","T1557.001"],"logsource":{"product":"windows","category":"dns_query"},"falsepositives":["Unknown"],"references":["https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025","https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html"],"source_path":"rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml","source_sha256":"5de8781de89e989c297ce5c3d6d24faa80591250ffa4305c65569fb3bbd96ae8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing\nid: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c\nrelated:\n    - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 # Potential Kerberos Coercion via DNS Object Spoofing\n      type: similar\n    - id: 5588576c-5898-4fac-bcdd-7475a60e8f43 # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing - Network\n      type: similar\nstatus: experimental\ndescription: |\n    Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.\n    The pattern \"1UWhRCAAAAA..BAAAA\" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.\n    Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.\n    It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records\n    to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.\nreferences:\n    - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025\n    - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-06-20\ntags:\n    - attack.collection\n    - attack.credential-access\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1557.001\n    - attack.t1187\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|contains|all:\n            - 'UWhRCA'\n            - 'BAAAA'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1187","id":"T1187","name":"Forced Authentication","page":"techniques/enterprise/T1187/"},{"key":"enterprise/T1557.001","id":"T1557.001","name":"Name Resolution Poisoning and SMB Relay","page":"techniques/enterprise/T1557.001/"}],"data_path":"data/detection-rules/e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c.json","kind":"sigma"}