Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

Detects DNS queries containing specific base64-encoded patterns ("UWhRCA" and "BAAAA") that are indicative of Kerberos coercion attacks via DNS object spoofing. This technique involves manipulating DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, forcing victim systems to authenticate to attacker-controlled hosts. This is a strong indicator of a Kerberos coercion attack, potentially related to vulnerabilities like CVE-2025-33073, where a marshaled CREDENTIAL_TARGET_INFORMATION structure is used.