Detecting Kerberos Authentication Relay Via CNAME Abuse

Wambua Thyaka@thyaka

•updated Jan 20, 2026•30•1•206

Detect a type of Kerberos coercion attack often facilitated by DNS manipulation. It looks for a device that asks for a specific server (DNS Query), gets redirected via a CNAME record to a different server, and immediately tries to authenticate to that new server using Kerberos.