Zeek DNS detection of suspicious Kerberos coercion pattern in query payload

Alert on Zeek DNS queries containing the base64 Kerberos coercion signature pattern tied to CREDENTIAL_TARGET_INFORMATION.

FreeUnreviewedSigmahighv1

zeek-dns-detection-of-suspicious-kerberos-coercion-pattern-in-query-payload-5588576c

title: Zeek DNS detection of suspicious Kerberos coercion pattern in query payload
id: 5667cd6f-e6cb-4019-88e4-2cf046d0a3be
related:
  - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
    type: similar
  - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c
    type: similar
  - id: 5588576c-5898-4fac-bcdd-7475a60e8f43
    type: derived
status: experimental
description: This rule flags Zeek DNS queries whose payload contains a specific base64-encoded signature associated with Kerberos coercion via DNS object spoofing. The matched pattern corresponds to marshaled CREDENTIAL_TARGET_INFORMATION data, which attackers can leverage to redirect or coerce authentication toward attacker-controlled targets. Telemetry required is Zeek DNS service logs capturing query strings that include both required substrings.
references:
  - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-20
tags:
  - attack.collection
  - attack.credential-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1557.001
  - attack.t1187
logsource:
  product: zeek
  service: dns
detection:
  selection:
    query|contains|all:
      - UWhRCA
      - BAAAA
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Zeek DNS queries whose payload contains a specific base64-encoded signature associated with Kerberos coercion via DNS object spoofing. The matched pattern corresponds to marshaled CREDENTIAL_TARGET_INFORMATION data, which attackers can leverage to redirect or coerce authentication toward attacker-controlled targets. Telemetry required is Zeek DNS service logs capturing query strings that include both required substrings.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.