huntrule

Windows Process Execution of KrbRelay Relaying Tool

Flags Windows process creation for KrbRelay.exe with Kerberos relaying-related command-line arguments.

FreeUnreviewedSigmahighv1
title: Windows Process Execution of KrbRelay Relaying Tool
id: 428d7e3e-bf63-4bab-bb8f-130a056e1ec6
status: test
description: This rule identifies execution of KrbRelay on Windows by matching a process image named KrbRelay.exe and command-line parameters associated with Kerberos relaying. Attackers can use KrbRelay to relay Kerberos authentication in credential access scenarios, so spotting its distinctive binaries and argument patterns is important. It relies on process creation telemetry including the executable name/path (Image) and full CommandLine string.
references:
  - https://github.com/cube0x0/KrbRelay
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_krbrelay.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-27
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \KrbRelay.exe
    - OriginalFileName: KrbRelay.exe
  selection_cli_1:
    CommandLine|contains|all:
      - " -spn "
      - " -clsid "
      - " -rbcd "
  selection_cli_2:
    CommandLine|contains|all:
      - shadowcred
      - clsid
      - spn
  selection_cli_3:
    CommandLine|contains|all:
      - "spn "
      - "session "
      - "clsid "
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e96253b8-6b3b-4f90-9e59-3b24b99cf9b4
    type: derived

What it detects

This rule identifies execution of KrbRelay on Windows by matching a process image named KrbRelay.exe and command-line parameters associated with Kerberos relaying. Attackers can use KrbRelay to relay Kerberos authentication in credential access scenarios, so spotting its distinctive binaries and argument patterns is important. It relies on process creation telemetry including the executable name/path (Image) and full CommandLine string.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.