Skip to content

Commit a55bc21

Browse files
swachchhanda000swachchhanda000
authored
Merge PR #5492 from @swachchhanda000 - Kerberos Coercion Via DNS SPN Spoofing
new: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network new: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation new: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing new: Attempts of Kerberos Coercion Via DNS SPN Spoofing
1 parent 3201382 commit a55bc21

File tree

4 files changed

+167
-0
lines changed

4 files changed

+167
-0
lines changed

‎rules/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
2+
id: 5588576c-5898-4fac-bcdd-7475a60e8f43
3+
related:
4+
- id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 # Potential Kerberos Coercion via DNS Object Spoofing
5+
type: similar
6+
- id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing
7+
type: similar
8+
status: experimental
9+
description: |
10+
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
11+
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
12+
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
13+
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
14+
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
15+
references:
16+
- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
17+
- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
18+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
19+
date: 2025-06-20
20+
tags:
21+
- attack.credential-access
22+
- attack.persistence
23+
- attack.privilege-escalation
24+
- attack.t1557.001
25+
- attack.t1187
26+
logsource:
27+
product: zeek
28+
service: dns
29+
detection:
30+
selection:
31+
query|contains|all:
32+
- 'UWhRCA' # Follows this pattern UWhRCAAAAA..BAAA
33+
- 'BAAAA'
34+
condition: selection
35+
falsepositives:
36+
- Unknown
37+
level: high

‎rules/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
title: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
2+
id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
3+
related:
4+
- id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing
5+
type: similar
6+
- id: 5588576c-5898-4fac-bcdd-7475a60e8f43 # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing - Network
7+
type: similar
8+
- id: 0ed99dda-6a35-11ef-8c99-0242ac120002 # Kerberos Coercion Via DNS SPN Spoofing Attempt
9+
type: similar
10+
status: experimental
11+
description: |
12+
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob
13+
matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
14+
commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
15+
attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
16+
where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
17+
Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.
18+
references:
19+
- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
20+
- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
21+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
22+
date: 2025-06-20
23+
tags:
24+
- attack.credential-access
25+
- attack.t1557.003
26+
- attack.persistence
27+
- attack.privilege-escalation
28+
logsource:
29+
product: windows
30+
service: security
31+
definition: |
32+
By default these events are not logged by default for MicrosoftDNS objects in Active Directory.
33+
To enable detection, configure an AuditRule on the DNS object container with the "CreateChild" permission for the "Everyone" principal.
34+
This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule).
35+
detection:
36+
selection_directory_service_changes:
37+
EventID:
38+
- 5136
39+
- 5137
40+
ObjectClass: 'dnsNode'
41+
ObjectDN|contains|all: # ObjectDN">DC=foo-11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=domain.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com</Data>
42+
- 'UWhRCA'
43+
- 'BAAAA'
44+
- 'CN=MicrosoftDNS'
45+
selection_directory_service_access:
46+
EventID: 4662
47+
AdditionalInfo|contains|all: # AdditionalInfo">DC=foo-11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=domain.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com</Data>
48+
- 'UWhRCA'
49+
- 'BAAAA'
50+
- 'CN=MicrosoftDNS'
51+
condition: 1 of selection_*
52+
fields:
53+
- SubjectUserName # It is important to check the AccountName field to identify the user, it is likely an low-privileged account that has been compromised.
54+
falsepositives:
55+
- Unknown
56+
level: high

‎rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
2+
id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c
3+
related:
4+
- id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 # Potential Kerberos Coercion via DNS Object Spoofing
5+
type: similar
6+
- id: 5588576c-5898-4fac-bcdd-7475a60e8f43 # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing - Network
7+
type: similar
8+
status: experimental
9+
description: |
10+
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
11+
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
12+
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
13+
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
14+
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
15+
references:
16+
- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
17+
- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
18+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
19+
date: 2025-06-20
20+
tags:
21+
- attack.credential-access
22+
- attack.persistence
23+
- attack.privilege-escalation
24+
- attack.t1557.001
25+
- attack.t1187
26+
logsource:
27+
product: windows
28+
category: dns_query
29+
detection:
30+
selection:
31+
QueryName|contains|all:
32+
- 'UWhRCA'
33+
- 'BAAAA'
34+
condition: selection
35+
falsepositives:
36+
- Unknown
37+
level: high

‎rules/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
title: Attempts of Kerberos Coercion Via DNS SPN Spoofing
2+
id: 0ed99dda-6a35-11ef-8c99-0242ac120002
3+
related:
4+
- id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
5+
type: similar
6+
status: experimental
7+
description: |
8+
Detects the presence of "UWhRC....AAYBAAAA" pattern in command line.
9+
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
10+
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
11+
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
12+
to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073.
13+
If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records,
14+
or checking for the presence of such records through the `nslookup` command.
15+
references:
16+
- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
17+
- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
18+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
19+
date: 2025-06-20
20+
tags:
21+
- attack.credential-access
22+
- attack.persistence
23+
- attack.privilege-escalation
24+
- attack.t1557.001
25+
- attack.t1187
26+
logsource:
27+
category: process_creation
28+
product: windows
29+
detection:
30+
selection:
31+
CommandLine|contains|all:
32+
- 'UWhRCA'
33+
- 'BAAAA'
34+
condition: selection
35+
falsepositives:
36+
- Unknown
37+
level: high

0 commit comments

Comments
 (0)