Skip to content

Commit 1f71191

Browse files
w0rk3rSamirbous
w0rk3r
and
Samirbous
authored
[New Rules] SPN Spoofing / Coercion Rules (#4815)
* [New Rules] SPN Spoofing / Coercion Rules * Apply suggestions from code review Co-authored-by: Samirbous <[email protected]> * Update rules/windows/credential_access_kerberos_coerce.toml * Update rules/windows/credential_access_kerberos_coerce_dns.toml Co-authored-by: Samirbous <[email protected]> * Update rules/windows/credential_access_kerberos_coerce.toml Co-authored-by: Samirbous <[email protected]> * . * Update rules/windows/credential_access_kerberos_coerce_dns.toml * Update rules/windows/credential_access_kerberos_coerce_dns.toml * Update pyproject.toml * missing tag --------- Co-authored-by: Samirbous <[email protected]>
1 parent 133a079 commit 1f71191

File tree

4 files changed

+243
-1
lines changed

4 files changed

+243
-1
lines changed

‎detection_rules/etc/non-ecs-schema.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
"AccessList": "keyword",
1414
"AccessMask": "keyword",
1515
"AccessMaskDescription": "keyword",
16+
"AdditionalInfo": "keyword",
1617
"AllowedToDelegateTo": "keyword",
1718
"AttributeLDAPDisplayName": "keyword",
1819
"AttributeValue": "keyword",

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "detection_rules"
3-
version = "1.2.18"
3+
version = "1.2.19"
44
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
55
readme = "README.md"
66
requires-python = ">=3.12"

‎rules/windows/credential_access_kerberos_coerce.toml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
[metadata]
2+
creation_date = "2025/06/14"
3+
integration = ["system", "windows"]
4+
maturity = "production"
5+
updated_date = "2025/06/14"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies the creation of a DNS record containing a base64-encoded blob matching the pattern "UWhRCA...BAAAA". This
11+
pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks.
12+
It is associated with tools and techniques that exploit SPN spoofing via DNS. Adversaries may abuse this to coerce
13+
victim systems into authenticating to attacker-controlled hosts while requesting Kerberos tickets for legitimate
14+
services (often the victim's own identity). This enables reflective Kerberos relay attacks, potentially resulting in
15+
privileged access such as NT AUTHORITY\\SYSTEM, without relying on NTLM fallback.
16+
"""
17+
from = "now-9m"
18+
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
19+
language = "kuery"
20+
license = "Elastic License v2"
21+
name = "Potential Kerberos Coercion via DNS-Based SPN Spoofing"
22+
note = """## Triage and analysis
23+
24+
> **Disclaimer**:
25+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
26+
27+
### Investigating Potential Kerberos Coercion via DNS-Based SPN Spoofing
28+
29+
### Possible investigation steps
30+
31+
- Review the event logs on the affected Windows host to confirm the presence of event code 5137, which indicates a directory service object modification.
32+
- Inspect the ObjectDN field to identify the full distinguished name of the created DNS record. Look for entries containing Base64-encoded segments matching UWhRCA...BAAAA, which are indicative of an embedded CREDENTIAL_TARGET_INFORMATION payload used in SPN spoofing.
33+
- Validate the associated user or computer account responsible for the DNS record creation. Investigate whether the account has legitimate administrative access to modify DNS zones or whether it may have been compromised.
34+
- Correlate with DNS query logs and network telemetry to determine if the suspicious DNS hostname was later queried or resolved by other hosts on the network. A match suggests the attacker moved forward with the coercion attempt.
35+
- Assess the permissions and access controls on the DNS zones to ensure they are appropriately configured and restrict unnecessary modifications by authenticated users.
36+
37+
### False positive analysis
38+
39+
- This activity is unlikely to happen legitimately.
40+
41+
### Response and remediation
42+
43+
- Review and remove the malicious DNS record containing the embedded CREDENTIAL_TARGET_INFORMATION Base64 payload (UWhRCA...BAAAA). Ensure that no additional coercion records exist in the same DNS zone.
44+
- Identify the source of the DNS modification by correlating the event with user context and host activity. Investigate whether the account used was compromised or misused.
45+
- Audit Kerberos ticket activity following the DNS record creation. Look for suspicious service ticket requests (Event ID 4769) or authentication attempts that could indicate a relay or privilege escalation attempt.
46+
- Temporarily isolate involved systems if signs of compromise or lateral movement are detected, especially if the record was successfully resolved and used for coercion.
47+
- Monitor network traffic for signs of Man-in-the-Middle activity, focusing on unusual DNS queries or redirections.
48+
- Escalate the incident to the security operations center (SOC) for further investigation and to assess the potential impact on other systems.
49+
"""
50+
references = [
51+
"https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025",
52+
"https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/",
53+
"https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html",
54+
"https://github.com/CICADA8-Research/RemoteKrbRelay/blob/main/README.md",
55+
"https://github.com/Orange-Cyberdefense/ocd-mindmaps/blob/main/excalimap/mindmap/ad/authenticated.md",
56+
]
57+
risk_score = 73
58+
rule_id = "f701be14-0a36-4e9a-a851-b3e20ae55f09"
59+
setup = """## Setup
60+
61+
The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
62+
Steps to implement the logging policy with Advanced Audit Configuration:
63+
64+
```
65+
Computer Configuration >
66+
Policies >
67+
Windows Settings >
68+
Security Settings >
69+
Advanced Audit Policies Configuration >
70+
Audit Policies >
71+
DS Access >
72+
Audit Directory Service Changes (Success,Failure)
73+
```
74+
75+
The above policy does not cover the target object by default (we still need it to be configured to generate events), so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.
76+
77+
```
78+
Set-AuditRule -AdObjectPath 'AD:\\CN=MicrosoftDNS,DC=DomainDNSZones,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights CreateChild -InheritanceFlags Descendents -AttributeGUID e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 -AuditFlags Success
79+
```
80+
"""
81+
severity = "high"
82+
tags = [
83+
"Domain: Endpoint",
84+
"OS: Windows",
85+
"Use Case: Threat Detection",
86+
"Tactic: Credential Access",
87+
"Data Source: Active Directory",
88+
"Use Case: Active Directory Monitoring",
89+
"Data Source: Windows Security Event Logs",
90+
"Resources: Investigation Guide",
91+
]
92+
timestamp_override = "event.ingested"
93+
type = "query"
94+
95+
query = '''
96+
(event.code:4662 and winlog.event_data.AdditionalInfo: *UWhRC*BAAAA*MicrosoftDNS*) or
97+
(event.code:5137 and winlog.event_data.ObjectDN: *UWhRC*BAAAA*MicrosoftDNS*)
98+
'''
99+
100+
101+
[[rule.threat]]
102+
framework = "MITRE ATT&CK"
103+
[[rule.threat.technique]]
104+
id = "T1557"
105+
name = "Adversary-in-the-Middle"
106+
reference = "https://attack.mitre.org/techniques/T1557/"
107+
[[rule.threat.technique.subtechnique]]
108+
id = "T1557.001"
109+
name = "LLMNR/NBT-NS Poisoning and SMB Relay"
110+
reference = "https://attack.mitre.org/techniques/T1557/001/"
111+
112+
113+
[[rule.threat.technique]]
114+
id = "T1187"
115+
name = "Forced Authentication"
116+
reference = "https://attack.mitre.org/techniques/T1187/"
117+
118+
119+
[rule.threat.tactic]
120+
id = "TA0006"
121+
name = "Credential Access"
122+
reference = "https://attack.mitre.org/tactics/TA0006/"
123+

‎rules/windows/credential_access_kerberos_coerce_dns.toml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
[metadata]
2+
creation_date = "2025/06/14"
3+
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "crowdstrike"]
4+
maturity = "production"
5+
updated_date = "2025/06/14"
6+
7+
[transform]
8+
[[transform.investigate]]
9+
label = "Show the related DNS events"
10+
providers = [
11+
[
12+
{ excluded = false, field = "dns.question.name", queryType = "phrase", value = "{{dns.question.name}}", valueType = "string" }
13+
]
14+
]
15+
relativeFrom = "now-48h/h"
16+
relativeTo = "now"
17+
18+
[rule]
19+
author = ["Elastic"]
20+
description = """
21+
Identifies queries to a DNS record containing a base64-encoded blob matching the pattern "UWhRCA...BAAAA". This pattern
22+
corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. It is
23+
associated with tools and techniques that exploit SPN spoofing via DNS. Adversaries may abuse this to coerce victim
24+
systems into authenticating to attacker-controlled hosts while requesting Kerberos tickets for legitimate services
25+
(often the victim's own identity), enabling attacks such as NTLM reflection.
26+
"""
27+
from = "now-9m"
28+
index = [
29+
"endgame-*",
30+
"logs-crowdstrike.fdr*",
31+
"logs-endpoint.events.network-*",
32+
"logs-sentinel_one_cloud_funnel.*",
33+
"logs-windows.sysmon_operational-*",
34+
]
35+
language = "eql"
36+
license = "Elastic License v2"
37+
name = "Potential Kerberos SPN Spoofing via Suspicious DNS Query"
38+
note = """## Triage and analysis
39+
40+
### Investigating Potential Kerberos SPN Spoofing via Suspicious DNS Query
41+
42+
> **Note**:
43+
> This investigation guide uses the [Investigate Markdown Plugin](https://www.elastic.co/guide/en/security/current/interactive-investigation-guides.html) introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
44+
45+
### Possible investigation steps
46+
47+
- Identify the system that issued the DNS query for the suspicious hostname. Determine whether it is a server or an end user device. This technique is typically only relevant against server systems, but queries originating from workstations may indicate compromise or misuse.
48+
- Identify attacker-controlled system by getting the IP addresses (`dns.resolved_ip`) that this DNS query resolved to by looking for the related `lookup_result` events.
49+
- $investigate_0
50+
- If this alert was triggered on a domain controller, escalate the investigation to involve the incident response team to determine the full scope of the breach as soon as possible.
51+
52+
### False positive analysis
53+
54+
- This activity is unlikely to happen legitimately.
55+
56+
### Response and remediation
57+
58+
- Review and remove malicious DNS records containing the embedded CREDENTIAL_TARGET_INFORMATION Base64 payload (UWhRCA...BAAAA). Ensure that no additional coercion records exist in the same DNS zone.
59+
- Isolate involved systems if signs of compromise or lateral movement are detected, especially if the record was successfully resolved and used for coercion.
60+
- Monitor network traffic for signs of Man-in-the-Middle activity, focusing on unusual DNS queries or redirections.
61+
- Escalate the incident to the security operations center (SOC) for further investigation and to assess the potential impact on other systems.
62+
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
63+
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
64+
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
65+
"""
66+
references = [
67+
"https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025",
68+
"https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/",
69+
"https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html",
70+
"https://github.com/CICADA8-Research/RemoteKrbRelay/blob/main/README.md",
71+
"https://github.com/Orange-Cyberdefense/ocd-mindmaps/blob/main/excalimap/mindmap/ad/authenticated.md",
72+
]
73+
risk_score = 73
74+
rule_id = "99ac5005-8a9e-4625-a0af-5f7bb447204b"
75+
severity = "high"
76+
tags = [
77+
"Domain: Endpoint",
78+
"OS: Windows",
79+
"Use Case: Threat Detection",
80+
"Tactic: Credential Access",
81+
"Data Source: Elastic Defend",
82+
"Data Source: Elastic Endgame",
83+
"Data Source: Crowdstrike",
84+
"Data Source: SentinelOne",
85+
"Data Source: Sysmon",
86+
"Resources: Investigation Guide",
87+
]
88+
timestamp_override = "event.ingested"
89+
type = "eql"
90+
91+
query = '''
92+
network where host.os.type == "windows" and dns.question.name : "*UWhRC*BAAAA*"
93+
'''
94+
95+
96+
[[rule.threat]]
97+
framework = "MITRE ATT&CK"
98+
[[rule.threat.technique]]
99+
id = "T1557"
100+
name = "Adversary-in-the-Middle"
101+
reference = "https://attack.mitre.org/techniques/T1557/"
102+
[[rule.threat.technique.subtechnique]]
103+
id = "T1557.001"
104+
name = "LLMNR/NBT-NS Poisoning and SMB Relay"
105+
reference = "https://attack.mitre.org/techniques/T1557/001/"
106+
107+
108+
[[rule.threat.technique]]
109+
id = "T1187"
110+
name = "Forced Authentication"
111+
reference = "https://attack.mitre.org/techniques/T1187/"
112+
113+
114+
[rule.threat.tactic]
115+
id = "TA0006"
116+
name = "Credential Access"
117+
reference = "https://attack.mitre.org/tactics/TA0006/"
118+

0 commit comments

Comments
 (0)