Potential KerberLoss SPN Uniqueness Bypass via Hidden Unicode
Detects a Value Added modification to the servicePrincipalName attribute where the new SPN value contains non-printable/invisible Unicode characters (e.g. zero-width spaces/joiners, soft hyphen, BOM, Mongolian vowel separator, or other invisible code points). This technique, described by Semperis in their 'Identity Crisis' research as KerberLoss (CVE-2026-25177), can be used to bypass SPN uniqueness verification by embedding hidden characters, enabling denial-of-service against HOST-mapped services, SPN-jacking for constrained delegation abuse, or Kerberos-to-NTLM downgrade.
Sigma
