HackTool - KrbRelayUp Execution

Title: HackTool - KrbRelayUp Execution
Status: test
Description:Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced
References:
  -https://github.com/Dec0ne/KrbRelayUp
Author: Florian Roth (Nextron Systems)
Date: 2022-04-26
modified:2023-02-04
Tags:

• -'attack.credential-access'
• -'attack.t1558.003'
• -'attack.lateral-movement'
• -'attack.t1550.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\KrbRelayUp.exe' OriginalFileName:'KrbRelayUp.exe'   selection_cli_1:
    CommandLine|contains|all:
      -' relay '
      -' -Domain '
      -' -ComputerName '

  selection_cli_2:
    CommandLine|contains|all:
      -' krbscm '
      -' -sc '

  selection_cli_3:
    CommandLine|contains|all:
      -' spawn '
      -' -d '
      -' -cn '
      -' -cp '

  condition:1 of selection_*
Falsepositives:
  -Unlikely
Level: high