Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

2025-06-20 00:00:00

None

e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c

attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5492 from @swachchhanda000 - Kerberos Coercion Via DNS SPN Spoofing

2025-07-08