Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing
Alerts on Windows DNS queries containing a base64-like credential target signature linked to Kerberos coercion via DNS spoofing.
- Product
- windows
- Category
- dns_query
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-06-20
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule matches Windows DNS queries whose QueryName contains a base64-derived pattern consistent with a Kerberos coercion signature tied to marshaled CREDENTIAL_TARGET_INFORMATION data. Such behavior matters because attackers can use DNS object/spoofing techniques to redirect or coerce authentication attempts toward attacker-controlled targets. It relies on telemetry that logs Windows DNS query names (QueryName) and checks for the specific substring markers present in the detection condition.
Reporting behind it
- synacktiv.comhttps://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
- googleprojectzero.blogspot.comhttps://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing
id: 6dabf949-0bd7-44c0-96fa-63d2c23f9a65
related:
- id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
type: similar
- id: 5588576c-5898-4fac-bcdd-7475a60e8f43
type: similar
- id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c
type: derived
status: experimental
description: This rule matches Windows DNS queries whose QueryName contains a base64-derived pattern consistent with a Kerberos coercion signature tied to marshaled CREDENTIAL_TARGET_INFORMATION data. Such behavior matters because attackers can use DNS object/spoofing techniques to redirect or coerce authentication attempts toward attacker-controlled targets. It relies on telemetry that logs Windows DNS query names (QueryName) and checks for the specific substring markers present in the detection condition.
references:
- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-20
tags:
- attack.collection
- attack.credential-access
- attack.persistence
- attack.privilege-escalation
- attack.t1557.001
- attack.t1187
logsource:
product: windows
category: dns_query
detection:
selection:
QueryName|contains|all:
- UWhRCA
- BAAAA
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1