Query: Sigma rule for Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "
Matching passage: Sigma rule: Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern ". Logsource: zeek / dns. Rule: title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network id: 5588576c-5898-4fac-bcdd-7475a60e8f43 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar status: experimental description: 'Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: product: zeek service: dns detection: selection: query|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects active directory enumeration activity using known AdFind CLI flags. Logsource: windows / process_creation. Rule: title: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE id: 455b9d50-15a1-4b99-853f-8d37655a4c1b related: - id: 9a132afa-654e-11eb-ae93-0242ac130002 type: similar - id: 514e7e3e-b3b4-4a67-af60-be20f139198b type: similar status: test description: Detects active directory enumeration activity using known AdFind CLI flags references: - https://www.joeware.net/freetools/tools/adfind/ - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md author: frack113 date: 2021-12-13 modified: 2023-03-05 tags: - attack.discovery - attack.t1087.002 logsource: product: windows category: process_creation detection: selection_password: CommandLine|contains: - lockoutduration - lockoutthreshold - lockoutobservationwindow - maxpwdage - minpwdage - minpwdlength - pwdhistorylength - pwdproperties selection_enum_ad: CommandLine|contains: -sc admincountdmp selection_enum_exchange: CommandLine|contains: -sc exchaddresses condition: 1 of selection_* falsepositives: - Authorized administrative activity level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration/info.yml