Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution
Flags and image indicators for RemoteKrbRelay execution on Windows, including relaying-related command-line actions.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-06-27
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of the RemoteKrbRelay tool on Windows by matching the process image name and specific command-line flags. RemoteKrbRelay can perform Kerberos relaying actions that may enable credential access or account/permission manipulation. It relies on process creation telemetry including the executable path/name and command-line arguments, plus PE metadata fields such as OriginalFileName.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution"
id: 00bb7e0e-ffd0-44ae-8efa-add5ebbeab71
status: test
description: This rule flags execution of the RemoteKrbRelay tool on Windows by matching the process image name and specific command-line flags. RemoteKrbRelay can perform Kerberos relaying actions that may enable credential access or account/permission manipulation. It relies on process creation telemetry including the executable path/name and command-line arguments, plus PE metadata fields such as OriginalFileName.
references:
- https://github.com/CICADA8-Research/RemoteKrbRelay
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-27
tags:
- attack.credential-access
- attack.t1558.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \RemoteKrbRelay.exe
- OriginalFileName: RemoteKrbRelay.exe
selection_cli_required:
CommandLine|contains|all:
- " -clsid "
- " -target "
- " -victim "
selection_cli_attack_smb:
CommandLine|contains|all:
- "-smb "
- "--smbkeyword "
CommandLine|contains:
- interactive
- secrets
- service-add
selection_cli_attack_rbcd_main:
CommandLine|contains: "-rbcd "
selection_cli_attack_rbcd_options:
CommandLine|contains:
- "-cn "
- "--computername "
selection_cli_attack_changepass:
CommandLine|contains: "-chp "
CommandLine|contains|all:
- "-chpPass "
- "-chpUser "
selection_cli_attack_addgrpname:
CommandLine|contains|all:
- "-addgroupmember "
- "-group "
- "-groupuser "
condition: selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: a7664b14-75fb-4a50-a223-cb9bc0afbacf
type: derived