huntrule

Windows File Drop Indicators for RemoteKrbRelay SMB Relay Secret Dump Module

Alerts on creation of RemoteKrbRelay-specific temp files used to stage secrets dump outputs on Windows.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2024-06-27
Updated
2026-07-31
AnalysisDetection
title: Windows File Drop Indicators for RemoteKrbRelay SMB Relay Secret Dump Module
id: 05789919-a7e6-4691-8409-dd3a691e37a4
status: test
description: This rule matches the creation of specific file names located in the Windows temp directory that are used as indicators by the RemoteKrbRelay SMB relay secrets dump module. Attackers rely on dropped artifacts to stage credential-related data during relay and extraction workflows. The detection relies on Windows file creation telemetry that includes the full target filename and supports suffix matching to identify the expected temp files.
references:
  - https://github.com/CICADA8-Research/RemoteKrbRelay/blob/19ec76ba7aa50c2722b23359bc4541c0a9b2611c/Exploit/RemoteKrbRelay/Relay/Attacks/RemoteRegistry.cs#L31-L40
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_krbrelay_remote_ioc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-27
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - :\windows\temp\sam.tmp
      - :\windows\temp\sec.tmp
      - :\windows\temp\sys.tmp
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3ab79e90-9fab-4cdf-a7b2-6522bc742adb
    type: derived