Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution

Flags Windows process creation for KrbRelay.exe with Kerberos relaying-related command-line arguments.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-04-27
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1558.003Kerberoasting
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies execution of the KrbRelay Kerberos relaying tool on Windows by matching process image names (KrbRelay.exe) and command-line parameters associated with SPN, CLSID, shadowcred, and RBCD-related usage. This behavior matters because Kerberos relaying tools can be used to access resources by coercing authentication flows. The detection relies on process creation telemetry including the executable path/name and full command-line arguments.

Reporting behind it

Related detections9 linkedT1558.003 — drag to rearrange

Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

Possible Kerberoasting via RC4 Service Ticket Requests

Suspicious LDAP Query Enumerating Kerberos Preauth Disabled Accounts with Whitespace Evasion

Suspicious Kerberoasting LDAP Search Filter for Service Principal Names

Suspicious Kerberoasting via RC4 Service Ticket Request for MSSQLSvc SPN (via security)

Malicious Kerberos Ticket File Creation Indicating Credential Theft (via file_event)

Suspicious Kerberoasting via setspn Service Principal Query

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

Possible Targeted Kerberoasting via servicePrincipalName Modification

Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution

Pivot detection · T1558.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-krbrelay-relaying-tool-e96253b8

title: "Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution"
id: 428d7e3e-bf63-4bab-bb8f-130a056e1ec6
status: test
description: Identifies execution of the KrbRelay Kerberos relaying tool on Windows by matching process image names (KrbRelay.exe) and command-line parameters associated with SPN, CLSID, shadowcred, and RBCD-related usage. This behavior matters because Kerberos relaying tools can be used to access resources by coercing authentication flows. The detection relies on process creation telemetry including the executable path/name and full command-line arguments.
references:
  - https://github.com/cube0x0/KrbRelay
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_krbrelay.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-27
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \KrbRelay.exe
    - OriginalFileName: KrbRelay.exe
  selection_cli_1:
    CommandLine|contains|all:
      - " -spn "
      - " -clsid "
      - " -rbcd "
  selection_cli_2:
    CommandLine|contains|all:
      - shadowcred
      - clsid
      - spn
  selection_cli_3:
    CommandLine|contains|all:
      - "spn "
      - "session "
      - "clsid "
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e96253b8-6b3b-4f90-9e59-3b24b99cf9b4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL