huntrule

Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing

Alert on Zeek DNS queries containing the base64 Kerberos coercion signature pattern tied to CREDENTIAL_TARGET_INFORMATION.

FreeReviewedSigma · High · v2
Product
zeek
Service
dns
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-06-20
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access → Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Zeek DNS queries that contain specific base64 substrings consistent with a marshaled CREDENTIAL_TARGET_INFORMATION signature used in Kerberos coercion via DNS object spoofing. Such traffic matters because attackers can manipulate DNS responses to spoof Service Principal Names (SPNs) and redirect authentication attempts toward attacker-controlled hosts. The detection relies on Zeek DNS query content matching the defined string fragments in the query field.

Reporting behind it

Related detections9 linkedT1187 — drag to rearrange
Suspicious Named Pipe Access for Authentication Coercion (via pipe_created)
Possible PetitPotam Coercion via IPC$ Named Pipe Access (via security)
Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing
Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing
Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Malicious Anonymous NTLM Network Logon (via security)
Suspicious Outlook Outbound Connection to SMB or HTTP Port
Suspicious LLMNR and NBT-NS Poisoning Tooling via ALPHA SPIDER (via process_creation)
Possible Progress WhatsUp Gold Path Traversal and UNC Coercion via core API (via webserver)
Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing
Pivot detection · T1187 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.