Skip to content
Threat Feed

Tag

Spn-Spoofing

1 brief RSS
high advisory

Potential Kerberos SPN Spoofing via Suspicious DNS Query

Detects suspicious DNS queries containing a base64-encoded blob, indicating potential Kerberos coercion attacks and SPN spoofing via DNS to coerce authentication to attacker-controlled hosts, enabling Kerberos or NTLM relay attacks.

Elastic Defend credential-access kerberos spn-spoofing dns windows
2r 1t