Query: alert when Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encode
Matching passage: Sigma rule: Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encode. Logsource: windows / process_creation. Rule: title: Attempts of Kerberos Coercion Via DNS SPN Spoofing id: 0ed99dda-6a35-11ef-8c99-0242ac120002 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar status: experimental description: 'Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the `nslookup` command. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (ED. Logsource: windows / security. Rule: title: Windows Filtering Platform Blocked Connection From EDR Agent Binary id: bacf58c6-e199-4040-a94f-95dea0f1e45a status: test description: 'Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events. ' references: - https://github.com/netero1010/EDRSilencer - https://github.com/amjcyber/EDRNoiseMaker - https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983 author: '@gott_cyber' date: 2024-01-08 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Connection needs to be enabled' detection: selection: EventID: 5157 Application|endswith: - \AmSvc.exe - \cb.exe - \CETASvc.exe - \CNTAoSMgr.exe - \CrAmTray.exe - \CrsSvc.exe - \CSFalconContainer.exe - \CSFalconService.exe - \CybereasonAV.exe - \CylanceSvc.exe - \cyserver.exe - \CyveraService.exe - \CyvrFsFlt.exe - \EIConnector.exe - \elastic-agent.exe - \elastic-endpoint.exe - \EndpointBasecamp.exe - \ExecutionPreventionSvc.exe - \filebeat.exe - \fortiedr.exe - \hmpalert.exe - \hurukai.exe - \LogProcessorService.exe - \mcsagent.exe - \mcsclient.exe - \MsMpEng.exe - \MsSense.exe - \Ntrtscan.exe - \PccNTMon.exe - \QualysAgent.exe - \RepMgr.exe - \RepUtils.exe - \RepUx.exe - \RepWAV.exe - \RepWSC.exe - \sedservice.exe - \SenseCncProxy.exe - \SenseIR.exe - \SenseNdr.exe - \SenseSampleUploader.exe - \SentinelAgent.exe - \SentinelAgentWorker.exe - \SentinelBrowserNativeHost.exe - \SentinelHelperService.exe - \SentinelServiceHost.exe - \SentinelStaticEngine.exe - \SentinelStaticEngineScanner.exe - \sfc.exe - \sophos ui.exe - \sophosfilescanner.exe - \sophosfs.exe - \sophoshealth.exe - \sophosips.exe - \sophosLivequeryservice.exe - \sophosnetfilter.exe - \sophosntpservice.exe - \sophososquery.exe - \sspservice.exe - \TaniumClient.exe - \TaniumCX.exe - \TaniumDetectEngine.exe - \TMBMSRV.exe - \TmCCSF.exe - \TmListen.exe - \TmWSCSvc.exe - \Traps.exe - \winlogbeat.exe - \WSCommunicator.exe - \xagt.exe condition: selection falsepositives: - Unlikely level: high