Windows DNS Query Contains Base64 Kerberos Coercion Credential Target Signature

title: Windows DNS Query Contains Base64 Kerberos Coercion Credential Target Signature
id: 6dabf949-0bd7-44c0-96fa-63d2c23f9a65
related:
  - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
    type: similar
  - id: 5588576c-5898-4fac-bcdd-7475a60e8f43
    type: similar
  - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c
    type: derived
status: experimental
description: This rule flags Windows DNS queries whose QueryName contains specific substrings that together match a base64-encoded signature associated with a marshaled CREDENTIAL_TARGET_INFORMATION structure. Such activity is used in Kerberos coercion scenarios where attackers leverage DNS object spoofing to influence authentication targets. It relies on DNS query telemetry, specifically the QueryName content observed in Windows DNS query logs.
references:
  - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-20
tags:
  - attack.collection
  - attack.credential-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1557.001
  - attack.t1187
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains|all:
      - UWhRCA
      - BAAAA
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1