Skip to content

Commit d74896a

Browse files
patel-bhavinpatel-bhavin
authored
Merge branch 'develop' into isovalent_batch_1
2 parents d170342 + 001a152 commit d74896a

File tree

5 files changed

+373
-0
lines changed

5 files changed

+373
-0
lines changed

‎detections/endpoint/windows_credential_target_information_structure_in_commandline.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Windows Credential Target Information Structure in Commandline
2+
id: f79c5d7a-dd99-4263-93e1-49ace5634c82
3+
version: 1
4+
date: '2025-11-13'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: Detects DNS-based Kerberos coercion attacks where adversaries
9+
inject marshaled credential structures into DNS records to spoof SPNs and
10+
redirect authentication such as in CVE-2025-33073. This detection leverages
11+
process creation events looking for specific CREDENTIAL_TARGET_INFORMATION structures.
12+
data_source:
13+
- Sysmon EventID 1
14+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
15+
as lastTime from datamodel=Endpoint.Processes where Processes.process="*1UWhRCA*"
16+
Processes.process="*AAAAA*" Processes.process="*YBAAAA*" by Processes.action
17+
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
18+
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
19+
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
20+
Processes.process_hash Processes.process_id Processes.process_integrity_level
21+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
22+
| `drop_dm_object_name(Processes)`
23+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
24+
| `windows_credential_target_information_structure_in_commandline_filter`'
25+
how_to_implement: The detection is based on data that originates from Endpoint Detection
26+
and Response (EDR) agents. These agents are designed to provide security-related
27+
telemetry from the endpoints where the agent is installed. To implement this search,
28+
you must ingest logs that contain the process GUID, process name, and parent process.
29+
Additionally, you must ingest complete command-line executions. These logs must
30+
be processed using the appropriate Splunk Technology Add-ons that are specific to
31+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
32+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
33+
names and speed up the data modeling process.
34+
known_false_positives: Commands with all of these base64 encoded values are unusual in production
35+
environments. Filter as needed.
36+
references:
37+
- https://web.archive.org/web/20250617122747/https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
38+
- https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx
39+
- https://www.guidepointsecurity.com/blog/the-birth-and-death-of-loopyticket/
40+
drilldown_searches:
41+
- name: View the detection results for - "$user$" and "$dest$"
42+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
46+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
47+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
48+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
49+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
50+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
51+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
52+
earliest_offset: $info_min_time$
53+
latest_offset: $info_max_time$
54+
rba:
55+
message: An instance of CREDENTIAL_TARGET_INFORMATION magic string was identified
56+
in a command on endpoint $dest$ by user $user$.
57+
risk_objects:
58+
- field: user
59+
type: user
60+
score: 44
61+
- field: dest
62+
type: system
63+
score: 44
64+
threat_objects: []
65+
tags:
66+
analytic_story:
67+
- Compromised Windows Host
68+
- Suspicious DNS Traffic
69+
- Local Privilege Escalation With KrbRelayUp
70+
- Kerberos Coercion with DNS
71+
asset_type: Endpoint
72+
mitre_attack_id:
73+
- T1557.001
74+
- T1187
75+
- T1071.004
76+
product:
77+
- Splunk Enterprise
78+
- Splunk Enterprise Security
79+
- Splunk Cloud
80+
security_domain: endpoint
81+
cve:
82+
- CVE-2025-33073
83+
tests:
84+
- name: True Positive Test
85+
attack_data:
86+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/kerberos_coercion/sysmon.log
87+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
88+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_kerberos_coercion_via_dns.yml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: Windows Kerberos Coercion via DNS
2+
id: 9029b575-6f6b-4ab1-b660-67b24b7e9c3d
3+
version: 1
4+
date: '2025-11-12'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: Detects DNS-based Kerberos coercion attacks where adversaries
9+
inject marshaled credential structures into DNS records to spoof SPNs and
10+
redirect authentication such as in CVE-2025-33073. This detection leverages
11+
Windows Security Event Codes 5136, 5137, 4662, looking for DNS events with
12+
specific CREDENTIAL_TARGET_INFORMATION entries.
13+
data_source:
14+
- Windows Event Log Security 4662
15+
- Windows Event Log Security 5136
16+
- Windows Event Log Security 5137
17+
search: '`wineventlog_security` (((EventCode="5136" OR EventCode="5137") ObjectClass="dnsNode"
18+
ObjectDN="*1UWhRCA*" ObjectDN="*AAAAA*" ObjectDN="*YBAAAA*") OR (EventCode="4662"
19+
AdditionalInfo="*1UWhRCA*" AdditionalInfo="*AAAAA*" AdditionalInfo="*YBAAAA*"))
20+
| eval Object=coalesce(lower(ObjectGUID), trim(AdditionalInfo2, "%{}"))
21+
| eval user=coalesce(SubjectUserName, Caller_User_Name)
22+
| stats min(_time) as firstTime, max(_time) as lastTime
23+
values(EventCode) as event_codes
24+
values(ObjectDN) as dns_record
25+
values(user) as user
26+
values(Computer) as dest
27+
by Object
28+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
29+
| `windows_kerberos_coercion_via_dns_filter`'
30+
how_to_implement: To successfully implement this search, you ned to be ingesting Event
31+
codes `4662`, `5136`, `5137`. The Advanced Security Audit policy setting `Audit Directory
32+
Services Changes` within `DS Access` needs to be enabled. For these event codes
33+
to be generated, specific SACLs are required.
34+
known_false_positives: Creating a DNS entry matching this pattern is very unusual in a
35+
production environment. Filter as needed.
36+
references:
37+
- https://web.archive.org/web/20250617122747/https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
38+
- https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx
39+
- https://www.guidepointsecurity.com/blog/the-birth-and-death-of-loopyticket/
40+
drilldown_searches:
41+
- name: View the detection results for - "$dest$"
42+
search: '%original_detection_search% | search Computer = "$dest$"'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
- name: View risk events for the last 7 days for - "$dest$"
46+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
47+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
48+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
49+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
50+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
51+
| `security_content_ctime(lastTime)`'
52+
earliest_offset: $info_min_time$
53+
latest_offset: $info_max_time$
54+
rba:
55+
message: A possible Kerberos coercion DNS object was created $dest$
56+
risk_objects:
57+
- field: dest
58+
type: system
59+
score: 74
60+
- field: user
61+
type: user
62+
score: 74
63+
threat_objects: []
64+
tags:
65+
analytic_story:
66+
- Compromised Windows Host
67+
- Suspicious DNS Traffic
68+
- Local Privilege Escalation With KrbRelayUp
69+
- Kerberos Coercion with DNS
70+
asset_type: Endpoint
71+
mitre_attack_id:
72+
- T1071.004
73+
- T1557.001
74+
- T1187
75+
product:
76+
- Splunk Enterprise
77+
- Splunk Enterprise Security
78+
- Splunk Cloud
79+
security_domain: endpoint
80+
cve:
81+
- CVE-2025-33073
82+
tests:
83+
- name: True Positive Test
84+
attack_data:
85+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/kerberos_coercion/windows-xml.log
86+
source: XmlWinEventLog:Security
87+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_short_lived_dns_record.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
name: Windows Short Lived DNS Record
2+
id: d585e253-1859-4170-977d-09376c731f74
3+
version: 1
4+
date: '2025-11-13'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic identifies the creation and quick deletion of
9+
a DNS object within 300 seconds in an Active Directory environment,
10+
indicative of a potential attack abusing DNS. This detection leverages Windows Security
11+
Event Codes 5136 and 5137, analyzing the duration between these events. This activity
12+
is significant as temporary DNS entries allows attackers to cause unexpecting network trafficking,
13+
leading to potential compromise.
14+
data_source:
15+
- Windows Event Log Security 5136
16+
- Windows Event Log Security 5137
17+
search: '`wineventlog_security` ((EventCode=5137 ObjectClass="dnsNode") OR (EventCode=5136
18+
ObjectClass="dnsNode" AttributeLDAPDisplayName="dNSTombstoned" AttributeValue="TRUE"))
19+
| stats min(_time) as firstTime
20+
max(_time) as lastTime
21+
values(EventCode) as event_codes
22+
values(ObjectDN) as dns_record
23+
values(SubjectUserName) as user
24+
values(Computer) as dest
25+
by ObjectGUID
26+
| where mvcount(event_codes)=2
27+
| eval time_diff=lastTime - firstTime
28+
| where time_diff <= 300
29+
| table firstTime, lastTime, dns_record, user, dest, time_diff, ObjectGUID
30+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
31+
| `windows_short_lived_dns_record_filter`'
32+
how_to_implement: To successfully implement this search, you ned to be ingesting Event
33+
codes `5136` and `5137`. The Advanced Security Audit policy setting `Audit Directory
34+
Services Changes` within `DS Access` needs to be enabled. For these event codes
35+
to be generated, specific SACLs are required.
36+
known_false_positives: Creating and deleting a DNS server object within 30 seconds or
37+
less is unusual but not impossible in a production environment. Filter as needed.
38+
references:
39+
- https://web.archive.org/web/20250617122747/https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
40+
- https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx
41+
- https://www.guidepointsecurity.com/blog/the-birth-and-death-of-loopyticket/
42+
drilldown_searches:
43+
- name: View the detection results for - "$dest$"
44+
search: '%original_detection_search% | search Computer = "$dest$"'
45+
earliest_offset: $info_min_time$
46+
latest_offset: $info_max_time$
47+
- name: View risk events for the last 7 days for - "$dest$"
48+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
49+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
50+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
51+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
52+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
53+
| `security_content_ctime(lastTime)`'
54+
earliest_offset: $info_min_time$
55+
latest_offset: $info_max_time$
56+
rba:
57+
message: A short-lived DNS object was created and deleted on $dest$
58+
risk_objects:
59+
- field: dest
60+
type: system
61+
score: 64
62+
- field: user
63+
type: user
64+
score: 64
65+
threat_objects: []
66+
tags:
67+
analytic_story:
68+
- Compromised Windows Host
69+
- Suspicious DNS Traffic
70+
- Local Privilege Escalation With KrbRelayUp
71+
- Kerberos Coercion with DNS
72+
asset_type: Endpoint
73+
mitre_attack_id:
74+
- T1071.004
75+
- T1557.001
76+
- T1187
77+
product:
78+
- Splunk Enterprise
79+
- Splunk Enterprise Security
80+
- Splunk Cloud
81+
security_domain: endpoint
82+
cve:
83+
- CVE-2025-33073
84+
tests:
85+
- name: True Positive Test
86+
attack_data:
87+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/kerberos_coercion/windows-xml.log
88+
source: XmlWinEventLog:Security
89+
sourcetype: XmlWinEventLog

‎detections/network/dns_kerberos_coercion.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: DNS Kerberos Coercion
2+
id: 8551252d-b5b6-4b6e-8a82-51460aeb29a3
3+
version: 1
4+
date: '2025-11-14'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: Detects DNS-based Kerberos coercion attacks where adversaries
9+
inject marshaled credential structures into DNS records to spoof SPNs and
10+
redirect authentication such as in CVE-2025-33073. This detection leverages
11+
suricata looking for specific CREDENTIAL_TARGET_INFORMATION structures in DNS
12+
queries.
13+
data_source:
14+
- Suricata
15+
- Sysmon EventID 22
16+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
17+
max(_time) as lastTime values(DNS.src) as src values(DNS.dest) as dest from datamodel=Network_Resolution
18+
where DNS.query="*1UWhRC*" DNS.query="*AAAAA*" DNS.query="*YBAAAA*" by DNS.answer
19+
DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product
20+
| `drop_dm_object_name(DNS)`
21+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
22+
| table firstTime lastTime query count src dest
23+
| `dns_kerberos_coercion_filter`'
24+
how_to_implement: To successfully implement this search, you will need to ensure that
25+
DNS data is populating the Network_Resolution data model.
26+
known_false_positives: It's unlikely that a DNS entry contains the specific structure used by
27+
this attack. Filter as needed for your organization.
28+
references:
29+
- https://web.archive.org/web/20250617122747/https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
30+
- https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx
31+
- https://www.guidepointsecurity.com/blog/the-birth-and-death-of-loopyticket/
32+
drilldown_searches:
33+
- name: View the detection results for - "$src$"
34+
search: '%original_detection_search% | search host = "$src$"'
35+
earliest_offset: $info_min_time$
36+
latest_offset: $info_max_time$
37+
- name: View risk events for the last 7 days for - "$src$"
38+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
39+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
40+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
41+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
42+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
43+
| `security_content_ctime(lastTime)`'
44+
earliest_offset: $info_min_time$
45+
latest_offset: $info_max_time$
46+
rba:
47+
message: A dns query $query$ with marshalled CREDENTIAL_TARGET_INFORMATION seen from $src$
48+
risk_objects:
49+
- field: src
50+
type: system
51+
score: 56
52+
threat_objects: []
53+
tags:
54+
analytic_story:
55+
- Compromised Windows Host
56+
- Suspicious DNS Traffic
57+
- Local Privilege Escalation With KrbRelayUp
58+
- Kerberos Coercion with DNS
59+
asset_type: Endpoint
60+
mitre_attack_id:
61+
- T1557.001
62+
- T1187
63+
- T1071.004
64+
product:
65+
- Splunk Enterprise
66+
- Splunk Enterprise Security
67+
- Splunk Cloud
68+
security_domain: network
69+
cve:
70+
- CVE-2025-33073
71+
tests:
72+
- name: True Positive Test
73+
attack_data:
74+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/kerberos_coercion/suricata.log
75+
source: Suricata
76+
sourcetype: suricata
77+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/kerberos_coercion/sysmon.log
78+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
79+
sourcetype: XmlWinEventLog

‎stories/kerberos_coercion_with_dns.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Kerberos Coercion with DNS
2+
id: bc6762a6-b66f-4be2-8a90-c58521069858
3+
version: 1
4+
status: production
5+
date: '2025-11-13'
6+
author: Raven Tait, Splunk
7+
description: Detects Kerberos coercion attacks via DNS manipulation. Identifies DNS record modifications
8+
where the Distinguished Name contains a base64-encoded CREDENTIAL_TARGET_INFORMATION structure.
9+
narrative: CVE-2025-33073 is a critical vulnerability related to Kerberos
10+
Reflection attacks impacting Active Directory environments. The journey began with a
11+
configuration involving a Domain Controller set up in a lab environment where offensive
12+
tradecraft was being developed. The attacker utilized a DNS record manipulation technique
13+
that involved appending a specific "magic string" to the hostname, which ultimately
14+
enabled successful coercive authentication, leading to remote code execution as SYSTEM.
15+
references:
16+
- https://web.archive.org/web/20250617122747/https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
17+
- https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx
18+
- https://www.guidepointsecurity.com/blog/the-birth-and-death-of-loopyticket/
19+
tags:
20+
category:
21+
- Adversary Tactics
22+
- Account Compromise
23+
- Lateral Movement
24+
product:
25+
- Splunk Enterprise
26+
- Splunk Enterprise Security
27+
- Splunk Cloud
28+
usecase: Advanced Threat Detection
29+
cve:
30+
- CVE-2025-33073

0 commit comments

Comments
 (0)