Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution

Flags and image indicators for RemoteKrbRelay execution on Windows, including relaying-related command-line actions.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2024-06-27
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1558.003Kerberoasting
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags execution of the RemoteKrbRelay tool on Windows by matching the process image name and specific command-line flags. RemoteKrbRelay can perform Kerberos relaying actions that may enable credential access or account/permission manipulation. It relies on process creation telemetry including the executable path/name and command-line arguments, plus PE metadata fields such as OriginalFileName.

Reporting behind it

Related detections9 linkedT1558.003 — drag to rearrange

Malicious Kerberos Ticket File Creation Indicating Credential Theft (via file_event)

Suspicious Kerberoasting via setspn Service Principal Query

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

Possible Targeted Kerberoasting via servicePrincipalName Modification

Suspicious SQL Service Principal Name Enumeration via Setspn

Windows: Suspicious Kerberos Ticket Requests from PowerShell Using KerberosRequestorSecurityToken

Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType

Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)

Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution

Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution

Pivot detection · T1558.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-remotekrbrelay-kerberos-relaying-tool-usage-a7664b14

title: "Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution"
id: 00bb7e0e-ffd0-44ae-8efa-add5ebbeab71
status: test
description: This rule flags execution of the RemoteKrbRelay tool on Windows by matching the process image name and specific command-line flags. RemoteKrbRelay can perform Kerberos relaying actions that may enable credential access or account/permission manipulation. It relies on process creation telemetry including the executable path/name and command-line arguments, plus PE metadata fields such as OriginalFileName.
references:
  - https://github.com/CICADA8-Research/RemoteKrbRelay
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \RemoteKrbRelay.exe
    - OriginalFileName: RemoteKrbRelay.exe
  selection_cli_required:
    CommandLine|contains|all:
      - " -clsid "
      - " -target "
      - " -victim "
  selection_cli_attack_smb:
    CommandLine|contains|all:
      - "-smb "
      - "--smbkeyword "
    CommandLine|contains:
      - interactive
      - secrets
      - service-add
  selection_cli_attack_rbcd_main:
    CommandLine|contains: "-rbcd "
  selection_cli_attack_rbcd_options:
    CommandLine|contains:
      - "-cn "
      - "--computername "
  selection_cli_attack_changepass:
    CommandLine|contains: "-chp "
    CommandLine|contains|all:
      - "-chpPass "
      - "-chpUser "
  selection_cli_attack_addgrpname:
    CommandLine|contains|all:
      - "-addgroupmember "
      - "-group "
      - "-groupuser "
  condition: selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a7664b14-75fb-4a50-a223-cb9bc0afbacf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL