This brief details the detection of DNS-based Kerberos coercion attacks, where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication, as seen in CVE-2025-33073, using Suricata and Sysmon event ID 22.
Fortinet edge appliances +37
kerberos
coercion
dns
cve-2025-33073
3r
3t
3i
updated