Query: write Sigma for Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blo
Matching passage: Sigma rule: Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blo. Logsource: windows / security. Rule: title: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 related: - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar - id: 5588576c-5898-4fac-bcdd-7475a60e8f43 type: similar - id: 0ed99dda-6a35-11ef-8c99-0242ac120002 type: similar status: experimental description: 'Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,. where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised. ' references: - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.t1557.003 - attack.persistence - attack.privilege-escalation logsource: product: windows service: security definition: 'By default these events are not logged by default for MicrosoftDNS objects in Active Directory. To enable detection, configure an AuditRule on the DNS object container with the "CreateChild" permission for the "Everyone" principal. This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule). ' detection: selection_directory_service_changes: EventID: - 5136 - 5137 ObjectClass: dnsNode ObjectDN|contains|all: - UWhRCA - BAAAA - CN=MicrosoftDNS selection_directory_service_access: EventID: 4662 AdditionalInfo|contains|all: - UWhRCA - BAAAA - CN=MicrosoftDNS condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the. Logsource: windows / registry_set. Rule: title: Register New IFiltre For Persistence id: b23818c7-e575-4d13-8012-332075ec0a2b status: test description: 'Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files. ' references: - https://persistence-info.github.io/Data/ifilters.html - https://twitter.com/0gtweet/status/1468548924600459267 - https://github.com/gtworek/PSBits/tree/master/IFilter - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2024-03-26 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection_ext: TargetObject|contains|all: - \SOFTWARE\Classes\. - \PersistentHandler selection_clsid: TargetObject|contains|all: - \SOFTWARE\Classes\CLSID - \PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF} filter_default_targets: TargetObject|contains: - \CLSID\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\ - \CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\ - \CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\ - \CLSID\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\ - \CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\ - \CLSID\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\ - \CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\ - \CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\ - \CLSID\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\ - \CLSID\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\ - \CLSID\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\ - \CLSID\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\ - \CLSID\{5e941d80-bf96-11cd-b579-08002b30bfeb}\ - \CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\ - \CLSID\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\ - \CLSID\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\ - \CLSID\{9694E38A-E081-46ac-99A0-8743C909ACB6}\ - \CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}\ - \CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\ - \CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\ - \CLSID\{d044309b-5da6-4633-b085-4ed02522e5a5}\ - \CLSID\{D169C14A-5148-4322-92C8-754FC9D018D8}\ - \CLSID\{DD75716E-B42E-4978-BB60-1497B92E30C4}\ - \CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\ - \CLSID\{E772CEB3-E203-4828-ADF1-765713D981B8}\ - \CLSID\{eec97550-47a9-11cf-b95