detection.wiki

Detection rules › Sigma

KrbRelayUp service installation (native)

Status
experimental
Severity
high
Log source
product windows, service system
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to escalate privileges while abusing KrbRelayUp attack.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1569 System Services

Event coverage

ProviderEvent
Service-Control-ManagerEvent ID 7045

Rule body yaml

title: KrbRelayUp service installation (native)
description: Detects scenarios where an attacker attempts to escalate privileges while abusing KrbRelayUp attack.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
- https://www.hub.trimarcsecurity.com/post/webcast-top-10-ways-to-improve-active-directory-security-quickly
- https://github.com/Dec0ne/KrbRelayUp/blob/main/README.md
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045 # service installation
    ServiceName: 'KrbSCM'
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 7045
  ServiceName: 'KrbSCM'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ServiceNameeq
  • KrbSCM corpus 3 (sigma 2, splunk 1)