Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1558.003Kerberoasting
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies execution of the KrbRelay Kerberos relaying tool on Windows by matching process image names (KrbRelay.exe) and command-line parameters associated with SPN, CLSID, shadowcred, and RBCD-related usage. This behavior matters because Kerberos relaying tools can be used to access resources by coercing authentication flows. The detection relies on process creation telemetry including the executable path/name and full command-line arguments.

Reporting behind it

Related detections9 linkedT1558.003 — drag to rearrange

Malicious Kerberos Ticket File Creation Indicating Credential Theft (via file_event)

Suspicious Kerberoasting via setspn Service Principal Query

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

Possible Targeted Kerberoasting via servicePrincipalName Modification

Suspicious SQL Service Principal Name Enumeration via Setspn

Windows: Suspicious Kerberos Ticket Requests from PowerShell Using KerberosRequestorSecurityToken

Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution

Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType

Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)

Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution

Pivot detection · T1558.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-krbrelay-relaying-tool-e96253b8

title: "Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution"
id: 428d7e3e-bf63-4bab-bb8f-130a056e1ec6
status: test
description: Identifies execution of the KrbRelay Kerberos relaying tool on Windows by matching process image names (KrbRelay.exe) and command-line parameters associated with SPN, CLSID, shadowcred, and RBCD-related usage. This behavior matters because Kerberos relaying tools can be used to access resources by coercing authentication flows. The detection relies on process creation telemetry including the executable path/name and full command-line arguments.
references:
  - https://github.com/cube0x0/KrbRelay
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_krbrelay.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-27
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \KrbRelay.exe
    - OriginalFileName: KrbRelay.exe
  selection_cli_1:
    CommandLine|contains|all:
      - " -spn "
      - " -clsid "
      - " -rbcd "
  selection_cli_2:
    CommandLine|contains|all:
      - shadowcred
      - clsid
      - spn
  selection_cli_3:
    CommandLine|contains|all:
      - "spn "
      - "session "
      - "clsid "
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e96253b8-6b3b-4f90-9e59-3b24b99cf9b4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL