Detectionhightest

HackTool - KrbRelayUp Execution

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Tue Apr 26Updated Sat Feb 0412827a56-61a4-476a-a9cb-f3068f191073windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\KrbRelayUp.exe'
        - OriginalFileName: 'KrbRelayUp.exe' # In case the file has been renamed after compilation
    selection_cli_1:
        CommandLine|contains|all:
            - ' relay '
            - ' -Domain '
            - ' -ComputerName '
    selection_cli_2:
        CommandLine|contains|all:
            - ' krbscm '
            - ' -sc '
    selection_cli_3:
        CommandLine|contains|all:
            - ' spawn '
            - ' -d '
            - ' -cn '
            - ' -cp '
    condition: 1 of selection_*