Windows Service Creation for KrbSCM via KrbRelayUp Tool

Flags creation of the KrbSCM Windows service, a known KrbRelayUp installation artifact.

FreeUnreviewedSigmahighv1

windows-service-creation-for-krbscm-via-krbrelayup-tool-e97d9903

title: Windows Service Creation for KrbSCM via KrbRelayUp Tool
id: 21556ad4-4557-40f6-a66e-452140e48d78
status: test
description: This rule detects Windows service installation events for the service name KrbSCM, associated with the KrbRelayUp tool. Attackers may use this to establish persistence or facilitate privilege escalation within a domain environment. The detection relies on Windows System event telemetry, specifically service creation recorded as EventID 7045 with ServiceName set to KrbSCM.
references:
  - https://github.com/Dec0ne/KrbRelayUp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_krbrelayup_service_installation.yml
author: Sittikorn S, Tim Shelton, Huntrule Team
date: 2022-05-11
modified: 2022-10-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceName: KrbSCM
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e97d9903-53b2-41fc-8cb9-889ed4093e80
    type: derived

What it detects

This rule detects Windows service installation events for the service name KrbSCM, associated with the KrbRelayUp tool. Attackers may use this to establish persistence or facilitate privilege escalation within a domain environment. The detection relies on Windows System event telemetry, specifically service creation recorded as EventID 7045 with ServiceName set to KrbSCM.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.