Windows AD DNS Record Changes Containing Kerberos CREDENTIAL_TARGET_INFORMATION Base64 Blob

title: Windows AD DNS Record Changes Containing Kerberos CREDENTIAL_TARGET_INFORMATION Base64 Blob
id: eafbaf49-2f0a-4b97-8247-17fb98f20734
related:
  - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c
    type: similar
  - id: 5588576c-5898-4fac-bcdd-7475a60e8f43
    type: similar
  - id: 0ed99dda-6a35-11ef-8c99-0242ac120002
    type: similar
  - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
    type: derived
status: experimental
description: This rule flags Active Directory DNS object modifications where the DNS node’s distinguished name includes a specific base64-encoded marker pattern associated with marshaled CREDENTIAL_TARGET_INFORMATION data. Such data is a strong indicator of Kerberos coercion techniques that rely on spoofing or manipulating Kerberos-related targets via DNS. The detection uses Windows Security events that record directory service create/delete activity and access events for MicrosoftDNS objects, matching event fields for the expected DN and encoded marker fragments. Investigate the account responsible for the change, as it is frequently compromised or used with low privileges to carry out coercion behavior.
references:
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
  - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-20
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1557.003
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: windows
  service: security
  definition: |
    By default these events are not logged by default for MicrosoftDNS objects in Active Directory.
    To enable detection, configure an AuditRule on the DNS object container with the "CreateChild" permission for the "Everyone" principal.
    This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule).
detection:
  selection_directory_service_changes:
    EventID:
      - 5136
      - 5137
    ObjectClass: dnsNode
    ObjectDN|contains|all:
      - UWhRCA
      - BAAAA
      - CN=MicrosoftDNS
  selection_directory_service_access:
    EventID: 4662
    AdditionalInfo|contains|all:
      - UWhRCA
      - BAAAA
      - CN=MicrosoftDNS
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1