huntrule

Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing

Alerts on Windows command lines containing 'UWhRCA' and 'BAAAA', a signature tied to Kerberos coercion via spoofed credential targeting.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-06-20
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access → Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the command line contains specific base64 signature fragments: "UWhRCA" and "BAAAA". The matched pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, which can be used as a strong indicator of Kerberos coercion activity involving DNS-record manipulation to spoof Service Principal Names (SPNs). Telemetry relied on is the command line from process creation logs, enabling detection of tooling or scripts that include this encoded target information in their arguments.

Reporting behind it

Related detections9 linkedT1187 — drag to rearrange
Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing
Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing
Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Suspicious LLMNR and NBT-NS Poisoning Tooling via ALPHA SPIDER (via process_creation)
Possible Progress WhatsUp Gold Path Traversal and UNC Coercion via core API (via webserver)
Masquerading Certificate Services Outbound LDAP or SMB Connection via Certighost Coercion (via network_connection)
Masquerading Exchange Server Impersonation via PrivExchange Relay Attack (via security)
Possible CVE-2023-23397 Outlook Forced Authentication via Outbound SMB (via network_connection)
Possible CVE-2023-23397 Outlook Forced Authentication via Outbound LDAP (via network_connection)
Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing
Pivot detection · T1187 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.