KrbRelayUp Service Installation

testhigh

log source: windows · systemauthor Sittikorn S, Tim Sheltondate 2022-05-11

description

What this is, in brief.

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

rule source (YAML)

title: KrbRelayUp Service Installation
id: e97d9903-53b2-41fc-8cb9-889ed4093e80
status: test
description: Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)
references:
    - https://github.com/Dec0ne/KrbRelayUp
author: Sittikorn S, Tim Shelton
date: 2022-05-11
modified: 2022-10-05
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'KrbSCM'
    condition: selection
falsepositives:
    - Unknown
level: high

detects techniques (1)

ATT&CK techniques this enables or maps to.

T1543Create or Modify System Process

references

External citations — patches, advisories, analysis.

https://github.com/Dec0ne/KrbRelayUp