Windows process execution: RemoteKrbRelay Kerberos relaying tool usage

title: "Windows process execution: RemoteKrbRelay Kerberos relaying tool usage"
id: 00bb7e0e-ffd0-44ae-8efa-add5ebbeab71
status: test
description: This rule identifies execution of the RemoteKrbRelay Windows binary and key command-line usage patterns associated with Kerberos relaying. Attackers can use this tool to relay Kerberos authentication to different targets and perform follow-on actions such as SMB interaction, RBCD configuration, password changes, or group membership updates. The detection relies on Windows process creation telemetry, matching the process image name and specific command-line flag combinations.
references:
  - https://github.com/CICADA8-Research/RemoteKrbRelay
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \RemoteKrbRelay.exe
    - OriginalFileName: RemoteKrbRelay.exe
  selection_cli_required:
    CommandLine|contains|all:
      - " -clsid "
      - " -target "
      - " -victim "
  selection_cli_attack_smb:
    CommandLine|contains|all:
      - "-smb "
      - "--smbkeyword "
    CommandLine|contains:
      - interactive
      - secrets
      - service-add
  selection_cli_attack_rbcd_main:
    CommandLine|contains: "-rbcd "
  selection_cli_attack_rbcd_options:
    CommandLine|contains:
      - "-cn "
      - "--computername "
  selection_cli_attack_changepass:
    CommandLine|contains: "-chp "
    CommandLine|contains|all:
      - "-chpPass "
      - "-chpUser "
  selection_cli_attack_addgrpname:
    CommandLine|contains|all:
      - "-addgroupmember "
      - "-group "
      - "-groupuser "
  condition: selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a7664b14-75fb-4a50-a223-cb9bc0afbacf
    type: derived