Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing
Alerts on Windows command lines containing 'UWhRCA' and 'BAAAA', a signature tied to Kerberos coercion via spoofed credential targeting.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-06-20
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains specific base64 signature fragments: "UWhRCA" and "BAAAA". The matched pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, which can be used as a strong indicator of Kerberos coercion activity involving DNS-record manipulation to spoof Service Principal Names (SPNs). Telemetry relied on is the command line from process creation logs, enabling detection of tooling or scripts that include this encoded target information in their arguments.
Reporting behind it
- synacktiv.comhttps://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
- googleprojectzero.blogspot.comhttps://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing"
id: e8ad3b0e-c9d0-4200-b899-79a1c1cb4c2b
related:
- id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
type: similar
- id: 0ed99dda-6a35-11ef-8c99-0242ac120002
type: derived
status: experimental
description: 'This rule flags Windows process creation events where the command line contains specific base64 signature fragments: "UWhRCA" and "BAAAA". The matched pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, which can be used as a strong indicator of Kerberos coercion activity involving DNS-record manipulation to spoof Service Principal Names (SPNs). Telemetry relied on is the command line from process creation logs, enabling detection of tooling or scripts that include this encoded target information in their arguments.'
references:
- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-20
tags:
- attack.collection
- attack.credential-access
- attack.persistence
- attack.privilege-escalation
- attack.t1557.001
- attack.t1187
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- UWhRCA
- BAAAA
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1