Metasploit - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/metasploit/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000DNS Kerberos Coercion Attempt Detectionhttps://feed.craftedsignal.io/briefs/2024-01-03-dns-kerberos-coercion/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-dns-kerberos-coercion/This brief details the detection of DNS-based Kerberos coercion attacks, where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication, as seen in CVE-2025-33073, using Suricata and Sysmon event ID 22.This brief addresses the threat of DNS-based Kerberos coercion attacks, which are designed to compromise authentication processes within a network. Attackers inject specifically crafted marshaled credential structures, identified by patterns like '1UWhRC', 'AAAAA', and 'YBAAAA', into DNS records. This injection allows the attacker to spoof Service Principal Names (SPNs) and redirect authentication requests, potentially leading to unauthorized access and lateral movement. The attack leverages vulnerabilities such as CVE-2025-33073. This activity has been observed leveraging both Suricata network monitoring and Windows Sysmon (Event ID 22) to detect the presence of these malicious DNS queries. Detection of this activity is critical to prevent Kerberos relay attacks and maintain the integrity of network authentication.

Attack Chain

  1. The attacker gains initial access to a compromised host within the network.
  2. The attacker crafts a malicious DNS query containing marshaled CREDENTIAL_TARGET_INFORMATION structures.
  3. The compromised host sends the malicious DNS query to the internal DNS server.
  4. The DNS server processes the query, unknowingly forwarding the malicious data.
  5. The attacker intercepts the DNS response and uses the spoofed SPN to initiate a Kerberos authentication request.
  6. The target server authenticates to the attacker-controlled service, relaying credentials.
  7. The attacker leverages the relayed credentials to gain unauthorized access to network resources.
  8. The attacker escalates privileges and moves laterally within the network, achieving their final objective.

Impact

A successful Kerberos coercion attack can lead to significant compromise of a network. By relaying credentials, attackers can gain unauthorized access to critical systems and data. While the exact number of potential victims is unknown, the impact can range from data breaches to complete network takeover. Sectors relying on Kerberos for authentication, such as government, finance, and healthcare, are particularly vulnerable. Successful exploitation allows attackers to escalate privileges, move laterally, and ultimately achieve their objectives, including data exfiltration or ransomware deployment.

Recommendation

  • Ensure that DNS data is properly ingested and correlated with the Network Resolution data model in your SIEM to facilitate detection using the provided search query.
  • Implement the provided Sigma rules to detect suspicious DNS queries containing marshaled credential structures based on Suricata and Sysmon event ID 22 logs.
  • Investigate and patch CVE-2025-33073 on all affected systems to prevent exploitation of the vulnerability.
  • Review and tune the provided Sigma rules for false positives, filtering as needed for your organization's specific environment based on the known false positives.
  • Enable Sysmon Event ID 22 logging to enhance visibility into DNS query activity on Windows endpoints.
]]>highadvisorykerberoscoerciondnscve-2025-33073