Windows File Drop Indicators for RemoteKrbRelay SMB Relay Secret Dump Module
Alerts on creation of RemoteKrbRelay-specific temp files used to stage secrets dump outputs on Windows.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-06-27
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches the creation of specific file names located in the Windows temp directory that are used as indicators by the RemoteKrbRelay SMB relay secrets dump module. Attackers rely on dropped artifacts to stage credential-related data during relay and extraction workflows. The detection relies on Windows file creation telemetry that includes the full target filename and supports suffix matching to identify the expected temp files.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows File Drop Indicators for RemoteKrbRelay SMB Relay Secret Dump Module
id: 05789919-a7e6-4691-8409-dd3a691e37a4
status: test
description: This rule matches the creation of specific file names located in the Windows temp directory that are used as indicators by the RemoteKrbRelay SMB relay secrets dump module. Attackers rely on dropped artifacts to stage credential-related data during relay and extraction workflows. The detection relies on Windows file creation telemetry that includes the full target filename and supports suffix matching to identify the expected temp files.
references:
- https://github.com/CICADA8-Research/RemoteKrbRelay/blob/19ec76ba7aa50c2722b23359bc4541c0a9b2611c/Exploit/RemoteKrbRelay/Relay/Attacks/RemoteRegistry.cs#L31-L40
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_krbrelay_remote_ioc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-27
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith:
- :\windows\temp\sam.tmp
- :\windows\temp\sec.tmp
- :\windows\temp\sys.tmp
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 3ab79e90-9fab-4cdf-a7b2-6522bc742adb
type: derived