Rule Info
Name
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Date
2025-06-20 00:00:00
Modified
None
Id
5588576c-5898-4fac-bcdd-7475a60e8f43
Tags
attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR