Detection rules › By eventMicrosoft-Windows-Security-Auditing event 513710 detection rules reference this event. View event page.Sigma (1)Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation severity high T1557.003 Elastic (5)Creation of a DNS-Named Record T1557, T1557.001 dMSA Account Creation by an Unusual User T1078, T1078.002, T1098, T1136, T1136.002 Potential ADIDNS Poisoning via Wildcard Record Creation T1557 Potential Kerberos Coercion via DNS-Based SPN Spoofing T1187, T1557, T1557.001 Potential WPAD Spoofing via DNS Record Creation T1557 Splunk (4)Windows AD Short Lived Server Object T1207 Windows Group Policy Object Created T1078.002, T1484.001 Windows Kerberos Coercion via DNS T1071.004, T1187, T1557.001 Windows Short Lived DNS Record T1071.004, T1187, T1557.001