Name:Windows Kerberos Coercion via DNS id:9029b575-6f6b-4ab1-b660-67b24b7e9c3d version:5 date:None author:Raven Tait, Splunk status:production type:TTP Description:Detects DNS-based Kerberos coercion attacks where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication such as in CVE-2025-33073. This detection leverages Windows Security Event Codes 5136, 5137, 4662, looking for DNS events with specific CREDENTIAL_TARGET_INFORMATION entries. Data_source:
-Windows Event Log Security 4662
-Windows Event Log Security 5136
-Windows Event Log Security 5137
search:`wineventlog_security` (((EventCode="5136" OR EventCode="5137") ObjectClass="dnsNode" ObjectDN="*1UWhRCA*" ObjectDN="*AAAAA*" ObjectDN="*YBAAAA*") OR (EventCode="4662" AdditionalInfo="*1UWhRCA*" AdditionalInfo="*AAAAA*" AdditionalInfo="*YBAAAA*"))
| stats min(_time) as firstTime, max(_time) as lastTime values(EventCode) as event_codes values(ObjectDN) as dns_record values(user) as user values(Computer) as dest BY Object
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_kerberos_coercion_via_dns_filter`
how_to_implement:To successfully implement this search, you ned to be ingesting Event codes `4662`, `5136`, `5137`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. For these event codes to be generated, specific SACLs are required. known_false_positives:Creating a DNS entry matching this pattern is very unusual in a production environment. Filter as needed. References: -https://web.archive.org/web/20250617122747/https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 -https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx -https://www.guidepointsecurity.com/blog/the-birth-and-death-of-loopyticket/ drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search Computer = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Compromised Windows Host', 'Suspicious DNS Traffic', 'Local Privilege Escalation With KrbRelayUp', 'Kerberos Coercion with DNS']
