detection.wiki

Detection rules › Sigma

KrbRelayUp service installation (native)

Status
experimental
Severity
high
Log source
product windows, service system
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to escalate privileges while abusing KrbRelayUp attack.

Known false positives

  • None

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

ProviderRecord / event type
Service-Control-ManagerEvent ID 7045: A service was installed in the system.

Rule body

title: KrbRelayUp service installation (native)
description: Detects scenarios where an attacker attempts to escalate privileges while abusing KrbRelayUp attack.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
- https://www.hub.trimarcsecurity.com/post/webcast-top-10-ways-to-improve-active-directory-security-quickly
- https://github.com/Dec0ne/KrbRelayUp/blob/main/README.md
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045 # service installation
    ServiceName: 'KrbSCM'
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 7045
  ServiceName: 'KrbSCM'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ServiceNameeq
  • KrbSCM corpus 3 (sigma 2, splunk 1)
field:"ServiceName" kind:eq value:"KrbSCM"