Windows Process Creation: Detect Kerberos Coercion Tooling via Base64 CREDENTIAL_TARGET_INFORMATION Pattern

Alerts on Windows command lines containing 'UWhRCA' and 'BAAAA', a signature tied to Kerberos coercion via spoofed credential targeting.

FreeUnreviewedSigmahighv1

windows-process-creation-detect-kerberos-coercion-tooling-via-base64-credential--0ed99dda

title: "Windows Process Creation: Detect Kerberos Coercion Tooling via Base64 CREDENTIAL_TARGET_INFORMATION Pattern"
id: e8ad3b0e-c9d0-4200-b899-79a1c1cb4c2b
related:
  - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
    type: similar
  - id: 0ed99dda-6a35-11ef-8c99-0242ac120002
    type: derived
status: experimental
description: This rule flags Windows process creation events whose command line contains both substrings 'UWhRCA' and 'BAAAA'. That combination matches a base64-encoded signature corresponding to a marshaled CREDENTIAL_TARGET_INFORMATION structure used in Kerberos coercion workflows. Such activity is significant because attackers may manipulate DNS/SPN resolution to redirect authentication attempts to attacker-controlled hosts. Telemetry required is Windows command-line data from process creation.
references:
  - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-20
tags:
  - attack.collection
  - attack.credential-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1557.001
  - attack.t1187
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - UWhRCA
      - BAAAA
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events whose command line contains both substrings 'UWhRCA' and 'BAAAA'. That combination matches a base64-encoded signature corresponding to a marshaled CREDENTIAL_TARGET_INFORMATION structure used in Kerberos coercion workflows. Such activity is significant because attackers may manipulate DNS/SPN resolution to redirect authentication attempts to attacker-controlled hosts. Telemetry required is Windows command-line data from process creation.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.