Windows AD DNS Record Modification Indicators for Kerberos Coercion via SPN DNS Spoofing
Alerts on AD MicrosoftDNS DNS node changes whose DN contains a CREDENTIAL_TARGET_INFORMATION base64 marker tied to Kerberos coercion.
- Product
- windows
- Service
- security
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-06-20
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Active Directory DNS object changes where the DNS node Distinguished Name contains a base64-encoded marker matching a marshaled CREDENTIAL_TARGET_INFORMATION pattern. Such tampering can support Kerberos coercion by redirecting authentication to attacker-controlled destinations through spoofed SPNs. It relies on Windows Security events for directory service object creation/modification and access (Event IDs 5136, 5137, and 4662) that include the targeted MicrosoftDNS object DN/AdditionalInfo.
Reporting behind it
- googleprojectzero.blogspot.comhttps://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
- synacktiv.comhttps://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AD DNS Record Modification Indicators for Kerberos Coercion via SPN DNS Spoofing
id: eafbaf49-2f0a-4b97-8247-17fb98f20734
related:
- id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c
type: similar
- id: 5588576c-5898-4fac-bcdd-7475a60e8f43
type: similar
- id: 0ed99dda-6a35-11ef-8c99-0242ac120002
type: similar
- id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
type: derived
status: experimental
description: This rule flags Active Directory DNS object changes where the DNS node Distinguished Name contains a base64-encoded marker matching a marshaled CREDENTIAL_TARGET_INFORMATION pattern. Such tampering can support Kerberos coercion by redirecting authentication to attacker-controlled destinations through spoofed SPNs. It relies on Windows Security events for directory service object creation/modification and access (Event IDs 5136, 5137, and 4662) that include the targeted MicrosoftDNS object DN/AdditionalInfo.
references:
- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-20
tags:
- attack.collection
- attack.credential-access
- attack.t1557.003
- attack.persistence
- attack.privilege-escalation
logsource:
product: windows
service: security
definition: |
By default these events are not logged by default for MicrosoftDNS objects in Active Directory.
To enable detection, configure an AuditRule on the DNS object container with the "CreateChild" permission for the "Everyone" principal.
This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule).
detection:
selection_directory_service_changes:
EventID:
- 5136
- 5137
ObjectClass: dnsNode
ObjectDN|contains|all:
- UWhRCA
- BAAAA
- CN=MicrosoftDNS
selection_directory_service_access:
EventID: 4662
AdditionalInfo|contains|all:
- UWhRCA
- BAAAA
- CN=MicrosoftDNS
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1