Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing
Alert on Zeek DNS queries containing the base64 Kerberos coercion signature pattern tied to CREDENTIAL_TARGET_INFORMATION.
- Product
- zeek
- Service
- dns
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-06-20
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule flags Zeek DNS queries that contain specific base64 substrings consistent with a marshaled CREDENTIAL_TARGET_INFORMATION signature used in Kerberos coercion via DNS object spoofing. Such traffic matters because attackers can manipulate DNS responses to spoof Service Principal Names (SPNs) and redirect authentication attempts toward attacker-controlled hosts. The detection relies on Zeek DNS query content matching the defined string fragments in the query field.
Reporting behind it
- synacktiv.comhttps://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
- googleprojectzero.blogspot.comhttps://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing
id: 5667cd6f-e6cb-4019-88e4-2cf046d0a3be
related:
- id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
type: similar
- id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c
type: similar
- id: 5588576c-5898-4fac-bcdd-7475a60e8f43
type: derived
status: experimental
description: This rule flags Zeek DNS queries that contain specific base64 substrings consistent with a marshaled CREDENTIAL_TARGET_INFORMATION signature used in Kerberos coercion via DNS object spoofing. Such traffic matters because attackers can manipulate DNS responses to spoof Service Principal Names (SPNs) and redirect authentication attempts toward attacker-controlled hosts. The detection relies on Zeek DNS query content matching the defined string fragments in the query field.
references:
- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-20
tags:
- attack.collection
- attack.credential-access
- attack.persistence
- attack.privilege-escalation
- attack.t1557.001
- attack.t1187
logsource:
product: zeek
service: dns
detection:
selection:
query|contains|all:
- UWhRCA
- BAAAA
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1