HackTool - KrbRelayUp Execution

 1title: HackTool - KrbRelayUp Execution
 2id: 12827a56-61a4-476a-a9cb-f3068f191073
 3status: test
 4description: Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced
 5references:
 6    - https://github.com/Dec0ne/KrbRelayUp
 7author: Florian Roth (Nextron Systems)
 8date: 2022-04-26
 9modified: 2023-02-04
10tags:
11    - attack.defense-evasion
12    - attack.credential-access
13    - attack.t1558.003
14    - attack.lateral-movement
15    - attack.t1550.003
16logsource:
17    category: process_creation
18    product: windows
19detection:
20    selection_img:
21        - Image|endswith: '\KrbRelayUp.exe'
22        - OriginalFileName: 'KrbRelayUp.exe' # In case the file has been renamed after compilation
23    selection_cli_1:
24        CommandLine|contains|all:
25            - ' relay '
26            - ' -Domain '
27            - ' -ComputerName '
28    selection_cli_2:
29        CommandLine|contains|all:
30            - ' krbscm '
31            - ' -sc '
32    selection_cli_3:
33        CommandLine|contains|all:
34            - ' spawn '
35            - ' -d '
36            - ' -cn '
37            - ' -cp '
38    condition: 1 of selection_*
39falsepositives:
40    - Unlikely
41level: high