Sigma rule: HackTool - RemoteKrbRelay Execution

Rule

Title

HackTool - RemoteKrbRelay Execution

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2024-06-27

File

rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\RemoteKrbRelay.exe'
    - OriginalFileName: 'RemoteKrbRelay.exe'
selection_cli_required:
    CommandLine|contains|all:
        - ' -clsid '
        - ' -target '
        - ' -victim '
# selection_cli_attacks:
#     # Note: In the current implementation these flags do not require any other flags. Which means they can't be used on their own. They're already covered by "selection_cli_required"
#     CommandLine|contains:
#         - '-adcs ' # relay to HTTP Web Enrollment and get certificate
#         - '-laps ' # relay to LDAP and extract LAPS passwords
#         - '-ldapwhoami ' # relay to LDAP and get info about relayed user
#         - '-shadowcred ' # relay to LDAP and setup Shadow Credentials
selection_cli_attack_smb:
    CommandLine|contains|all:
        - '-smb ' # relay to SMB
        - '--smbkeyword '
    CommandLine|contains:
        - 'interactive'
        - 'secrets'
        - 'service-add'
selection_cli_attack_rbcd_main:
    CommandLine|contains: '-rbcd ' # relay to LDAP and setup RBCD
selection_cli_attack_rbcd_options:
    CommandLine|contains:
        - '-cn ' # Computer name that will be written to msDs-AllowedToActOnBehalfOfOtherIdentity
        - '--computername ' # Computer name that will be written to msDs-AllowedToActOnBehalfOfOtherIdentity
selection_cli_attack_changepass:
    CommandLine|contains: '-chp ' # relay to LDAP and change user password
    CommandLine|contains|all:
        - '-chpPass ' # new password
        - '-chpUser ' # the name of the user whose password you want to change
selection_cli_attack_addgrpname:
    CommandLine|contains|all:
        - '-addgroupmember ' # relay to LDAP and add user to group
        - '-group '
        - '-groupuser '
condition: selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb

False positives (as the rule lists them)

• Unlikely

Tags

• attack.credential-access
• attack.t1558.003

MITRE ATT&CK ids this rule names

• T1558.003

References

• https://github.com/CICADA8-Research/RemoteKrbRelay

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml