Sigma rule: Potential Privilege Escalation via Local Kerberos Relay over LDAP

Rule

Title

Potential Privilege Escalation via Local Kerberos Relay over LDAP

Status

test

Level

high

Author

Elastic, @SBousseaden

Date

2022-04-27

Modified

2024-08-13

File

rules/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Log source

product

windows

service

security

Detection

selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: 'Kerberos'
    IpAddress: '127.0.0.1'
    TargetUserSid|startswith: 'S-1-5-21-'
    TargetUserSid|endswith: '-500'
filter_main_ip_null:
    IpPort: '0'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.credential-access
• attack.t1548

MITRE ATT&CK ids this rule names

• T1548

References

• https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g
• https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml