Name:Windows AD SPN Unicode Collision Injection id:d2d2c043-57a6-4aca-be43-ebb402dbb9e5 version:1 date:None author:Raven Tait, Splunk status:production type:TTP Description:The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136.
This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner).
LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account.
The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade. Data_source:
-Windows Event Log Security 5136
search:`wineventlog_security` EventCode=5136 AttributeValue=* AttributeLDAPDisplayName=servicePrincipalName OperationType IN ( "%%14674", "%%14675" )
| where isnotnull(matched_invisible_chars) | rename Computer as dest
| stats count min(_time) as firstTime max(_time) as lastTime values(matched_invisible_chars) as matched_invisible_chars by dest SubjectUserName SubjectDomainName ObjectDN ObjectClass AttributeValue
how_to_implement:To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. Additionally, a WriteProperty audit SACL must be configured on the computer object class (or the CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. known_false_positives:Legitimate use of invisible Unicode characters in SPN values is not expected. This detection should have a very low false positive rate.
Provisioning tools or scripts that incorrectly encode SPN strings from certain character sets may trigger this.
Verify the SubjectUserName and ObjectDN to confirm intent. References: -https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ -https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 -https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 drilldown_searches: name:'View the detection results for - "$SubjectUserName$"' search:'%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$SubjectUserName$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Active Directory Kerberos Attacks', 'Compromised User Account', 'Sneaky Active Directory Persistence Tricks']
