Loading story…
Splunk published two detections for Active Directory service principal name (SPN) manipulation, including the KerberLoss technique associated with CVE-2026-25177, which Microsoft lists as an Active Directory Domain Services elevation-of-privilege vulnerability. According to Splunk, inconsistent normalization between LDAP uniqueness checks and the Kerberos Key Distribution Center allows SPNs containing invisible Unicode characters to collide, potentially disrupting Kerberos authentication or forcing clients to fall back to NTLM. One analytic flags suspicious Unicode in SPN changes; the other detects non-machine accounts adding or removing SPNs on computer objects, activity that can reflect abuse of delegated WriteProperty permissions. Splunk also released an attack-simulation dataset capturing both behaviors; the references do not establish exploitation in the wild.
Both analytics rely on Windows Security Event 5136 and require domain controller Security logs, successful Directory Service Changes auditing, and appropriate WriteProperty audit SACLs on monitored objects. Defenders should verify these prerequisites, enable the detections—which are disabled by default—and investigate the modifying account, affected object, and changed SPN values. Microsoft recommends correlating Value Added and Value Deleted events using their shared Correlation ID to reconstruct attribute changes. Legitimate administration and provisioning can trigger the broader SPN-modification analytic, which produces intermediate risk findings rather than direct notable alerts; the Unicode-collision analytic is expected to generate few false positives. Review delegated SPN-write permissions and distinguish authorized changes from suspicious modifications.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Splunk's dated KerberLoss dataset entry documents an attack_range simulation in which a user account modified computer SPNs and injected invisible Unicode characters. The collected Windows Security logs record the activity through Event 5136; the entry states that no specific detections currently use the dataset for testing.
Splunk updated its Windows AD SPN Unicode Collision Injection detection for KerberLoss, associated with CVE-2026-25177. The analytic examines Event 5136 for invisible Unicode characters in SPNs that could trigger Kerberos denial-of-service or NTLM fallback through inconsistent LDAP and KDC normalization.
Splunk updated its Windows AD Computer SPN Modified By User Account analytic to identify non-machine accounts adding or removing computer servicePrincipalName values through Event 5136. The detection references CVE-2026-25177 and flags activity potentially associated with abuse of delegated WriteProperty permissions.
A Metasploit pull request introduces an auxiliary module for auditing and exercising CVE-2026-25177, with AUDIT, CHECK, HIJACK, and CLEANUP actions tested against an isolated Windows Server 2019 domain controller. The module demonstrates hidden-character SPN resolution through LDAP but warns that requesting and decrypting a service ticket is necessary to establish cryptographically verified ticket hijacking.
Microsoft's vulnerability advisory identifies CVE-2026-25177 as an Active Directory Domain Services elevation-of-privilege vulnerability. The supplied advisory reference provides no patch or exploitation details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourcemsrc.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Semperis disclosed two Active Directory privilege-escalation vulnerabilities involving hidden and unfilterable Unicode characters that can undermine Microsoft’s identity protections. The first flaw, **KerberLoss** (`CVE-2026-25177`), lets a low-privileged user with service principal name (SPN) write permissions bypass SPN and SPN-alias uniqueness checks, enabling denial of service against `HOST`-mapped services, SPN-jacking in constrained delegation scenarios, and forced Kerberos-to-NTLM downgrade. The second flaw, **ResetNightmare** (`CVE-2026-27912`), is more severe and allows an attacker who can write a user principal name (UPN) on a user or computer object to abuse NT-ENTERPRISE name handling and the Kerberos password-change protocol to reset a privileged account’s password and gain Domain Admin access. The findings build on Microsoft’s earlier hardening work for `CVE-2021-42282`, which introduced uniqueness verification for UPNs, SPNs, and SPN aliases, but the new research shows those checks could still be bypassed under certain conditions. Microsoft patched **KerberLoss** in March 2026 and **ResetNightmare** in April 2026. Defenders were urged to update domain controllers, restrict delegated rights that allow SPN or UPN modification, and monitor Active Directory changes—particularly suspicious SPN and UPN edits such as **Event ID 5136**—for signs of exploitation.
Aug 6, 2026
Splunk removed several Windows-focused detections from its Threat Research content library and Enterprise Security workflows, citing renamed analytics, overly broad logic, excessive noise, or reduced effectiveness against current attacker tradecraft. The retired content covered **local administrator account creation** with `net.exe`, **domain and local account discovery**, **domain and privileged group enumeration**, **Excel spawning PowerShell**, **Mimikatz-related credential dumping**, and an **Investigation** for pass-the-hash activity based on Windows Event ID `4624` with `Logon_Type 9`. Splunk said most of the detections were removed in content library version `5.2.0`, while the pass-the-hash investigation was dropped because Enterprise Security `8.0` no longer supports Investigations. The affected detections mapped to common ATT&CK behaviors including `T1136.001` (local account creation), `T1087.001` and `T1087.002` (account discovery), `T1069.002` (domain group discovery), `T1003.001` (LSASS memory), and pass-the-hash activity involving dumped **NTLM** credentials. The changes reflect the difficulty of reliably detecting Windows credential access and reconnaissance techniques that remain widely used by threat actors, including **SAM** hive dumping (`T1003.002`) with tools such as **Mimikatz**, **Impacket/SecretsDump**, **CrackMapExec**, and **Cobalt Strike**, as documented by MITRE ATT&CK. Splunk directed users to newer replacements such as **Windows Create Local Administrator Account Via Net**, **Windows User Discovery Via Net**, **Windows Group Discovery Via Net**, **Windows Sensitive Group Discovery With Net**, and **Windows Office Product Spawned Uncommon Process**.
Aug 12, 2026
Splunk has removed its deprecated **"Network Connection Discovery With Net"** analytic and replaced it with **"Windows Network Connection Discovery Via Net"**, updating the detection logic for suspicious use of `net.exe` and `net1.exe` on Windows systems. The analytic is designed to surface command-line activity associated with **MITRE ATT&CK `T1049`**, which covers adversary reconnaissance of active network connections, open ports, sessions, and reachable resources after initial compromise. MITRE documents `T1049` as a common post-compromise behavior used by APT groups, ransomware operators, and malware families to map local network connectivity through utilities such as `netstat`, `net use`, and `net session`, as well as Windows networking APIs. Splunk said the detection relies on telemetry including **Sysmon Event ID 1**, **Windows Security Event ID 4688**, and **CrowdStrike ProcessRollup2** normalized into the Splunk Endpoint data model, and noted that while the activity can indicate reconnaissance supporting lateral movement or data exfiltration, administrators may also trigger it during legitimate troubleshooting.
Aug 12, 2026