Potential Kerberos Relaying Activity - MDE

Time window: 20s
Group by: DeviceId, DeviceName
Author: Cyb3rMonk
Source: github.com/Cyb3r-Monk/Threat-Hunting-and-Detection

The below query detects potential Kerberos relaying event chain generated by KrbRelay.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	No specific technique

References

https://github.com/cube0x0/KrbRelay

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceEvents` action `any`: Defender event
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ConnectionSuccess`: Connection succeeded
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ListeningConnectionCreated`: Listening connection created
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `any`: Network activity
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `ProcessCreated`: Process created
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

// Author       : Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://mergene.medium.com)
//
// Link to original post:
// https://posts.bluraven.io/detecting-kerberos-relaying-e6be66fa647c
//
// Description: This query detects potential Kerberos relaying event chain generated by KrbRelay(https://github.com/cube0x0/KrbRelay).
//
// Query parameters:
//
union DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents
| where Timestamp > ago(60m)
| extend PipeName_ = tostring(todynamic(AdditionalFields).PipeName)
| extend Action = case(
    (ActionType=="ConnectionSuccess" and RemotePort in (389, 636)), 'ConnectToDC', 
    (ActionType=="ListeningConnectionCreated"), 'ListeningConnectionCreated', 
    (ActionType=="NamedPipeEvent" and PipeName_ has @"Winsock2\CatalogChangeListener"), 'NamedPipeEvent',
    (ActionType=="ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p"), 'DcomProcessCreated',
    (ActionType=="ConnectionSuccess" and LocalIP==RemoteIP and InitiatingProcessParentFileName=="svchost.exe"), 'DcomProcessConnecToSelf', 'Other'
    )
| summarize Actions = make_set_if(Action, Action <> "Other") by DeviceId, DeviceName, bin(Timestamp,20s)
| where array_length(Actions)==5
| project-rename ActivityTimestamp = Timestamp
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(60m)
    | where ActionType=="ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p"
    ) on DeviceId
    | where abs(datetime_diff('second', Timestamp, ActivityTimestamp)) <=20

union DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents
| where Timestamp > ago(60m)
| extend PipeName_ = tostring(todynamic(AdditionalFields).PipeName)
| where 
    (ActionType=="ConnectionSuccess" and RemotePort in (389, 636)) or 
    (ActionType=="ListeningConnectionCreated") or 
    (ActionType=="NamedPipeEvent" and PipeName_ has @"Winsock2\CatalogChangeListener") or
    (ActionType=="ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p") or
    (ActionType=="ConnectionSuccess" and LocalIP==RemoteIP and InitiatingProcessParentFileName=="svchost.exe")
    | sort by Timestamp desc

Stages and Predicates

union (3 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents

Leg 1: `DeviceProcessEvents`

Leg 2: `DeviceEvents`

Leg 3: `DeviceNetworkEvents`

Applied to the combined result

| where Timestamp > ago(60m) | extend PipeName_ = tostring(todynamic(AdditionalFields).PipeName) | extend Action = case(
    (ActionType=="ConnectionSuccess" and RemotePort in (389, 636)), 'ConnectToDC', 
    (ActionType=="ListeningConnectionCreated"), 'ListeningConnectionCreated', 
    (ActionType=="NamedPipeEvent" and PipeName_ has @"Winsock2\CatalogChangeListener"), 'NamedPipeEvent',
    (ActionType=="ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p"), 'DcomProcessCreated',
    (ActionType=="ConnectionSuccess" and LocalIP==RemoteIP and InitiatingProcessParentFileName=="svchost.exe"), 'DcomProcessConnecToSelf', 'Other'
    ) | summarize Actions = make_set_if(Action, Action <> "Other") by DeviceId, DeviceName, bin(Timestamp,20s) | where array_length(Actions)==5 | project-rename ActivityTimestamp = Timestamp | join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(60m)
    | where ActionType=="ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p"
    ) on DeviceId | where abs(datetime_diff('second', Timestamp, ActivityTimestamp)) <=20

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`ConnectionSuccess` `ListeningConnectionCreated` `NamedPipeEvent` `ProcessCreated`	`field:"ActionType" kind:eq`
`InitiatingProcessCommandLine`	eq	`svchost.exe -k DcomLaunch -p`	`field:"ParentCommandLine" kind:eq value:"svchost.exe -k DcomLaunch -p"`
`InitiatingProcessParentFileName`	eq	`svchost.exe`	`field:"GrandParentImage" kind:eq value:"svchost.exe"`
`LocalIP`	cross_field_compare	`RemoteIP` transforms: `op:eq`	`field:"src_ip" kind:cross_field_compare value:"RemoteIP"`
`PipeName_`	match	`Winsock2\CatalogChangeListener` transforms: `term`	`field:"PipeName_" kind:match value:"Winsock2\CatalogChangeListener"`
`RemotePort`	in	`389` `636`	`field:"DestinationPort" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Actions`	`summarize`
`DeviceId`	`summarize`
`DeviceName`	`summarize`
`ActivityTimestamp`	`project-rename`