Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•45

Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching a pattern indicative of a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is commonly used in Kerberos coercion attacks where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, such as in CVE-2025-33073. Investigation should focus on the user account making the changes, as it is likely a compromised low-privileged account.