Query: detect Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blo in logs
Matching passage: Sigma rule: Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blo. Logsource: windows / security. Rule: title: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 related: - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar - id: 5588576c-5898-4fac-bcdd-7475a60e8f43 type: similar - id: 0ed99dda-6a35-11ef-8c99-0242ac120002 type: similar status: experimental description: 'Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,. where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised. ' references: - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.t1557.003 - attack.persistence - attack.privilege-escalation logsource: product: windows service: security definition: 'By default these events are not logged by default for MicrosoftDNS objects in Active Directory. To enable detection, configure an AuditRule on the DNS object container with the "CreateChild" permission for the "Everyone" principal. This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule). ' detection: selection_directory_service_changes: EventID: - 5136 - 5137 ObjectClass: dnsNode ObjectDN|contains|all: - UWhRCA - BAAAA - CN=MicrosoftDNS selection_directory_service_access: EventID: 4662 AdditionalInfo|contains|all: - UWhRCA - BAAAA - CN=MicrosoftDNS condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a potentially suspicious powershell script executions from temporary folder. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Powershell Script Execution From Temp Folder id: a6a39bdb-935c-4f0a-ab77-35f4bbf44d33 status: test description: Detects a potentially suspicious powershell script executions from temporary folder references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton date: 2021-07-14 modified: 2026-02-17 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - \Windows\Temp - \Temporary Internet - \AppData\Local\Temp - \AppData\Roaming\Temp - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' filter_optional_vscode: CommandLine|contains: -WindowStyle hidden -Verb runAs filter_optional_amazon_ec2: CommandLine|contains: \Windows\system32\config\systemprofile\AppData\Local\Temp\Amazon\EC2-Windows\ filter_optional_generic: CommandLine|contains: - ' >' - Out-File - ConvertTo-Json filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: selection and not 1 of filter_optional_* falsepositives: - Administrative scripts level: medium