Windows: Detect KrbRelayUp.exe Process Execution with Relay, Domain and SCM Spawn Arguments

title: "Windows: Detect KrbRelayUp.exe Process Execution with Relay, Domain and SCM Spawn Arguments"
id: 6dcf7738-0ad7-44cf-a66f-ce3a975e2c5f
status: test
description: This rule identifies execution of KrbRelayUp.exe based on the process image name (including renamed binaries) and characteristic command-line arguments used for relay and domain/SCM-based spawning. Such tooling is associated with credential and privilege escalation workflows in Windows domain environments, making process creation telemetry valuable for spotting misuse early. It relies on Windows process creation logs capturing the executable path and full command line.
references:
  - https://github.com/Dec0ne/KrbRelayUp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_krbrelayup.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-26
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1558.003
  - attack.lateral-movement
  - attack.t1550.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \KrbRelayUp.exe
    - OriginalFileName: KrbRelayUp.exe
  selection_cli_1:
    CommandLine|contains|all:
      - " relay "
      - " -Domain "
      - " -ComputerName "
  selection_cli_2:
    CommandLine|contains|all:
      - " krbscm "
      - " -sc "
  selection_cli_3:
    CommandLine|contains|all:
      - " spawn "
      - " -d "
      - " -cn "
      - " -cp "
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 12827a56-61a4-476a-a9cb-f3068f191073
    type: derived