{"id":"a7664b14-75fb-4a50-a223-cb9bc0afbacf","title":"HackTool - RemoteKrbRelay Execution","description":"Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-06-27","modified":"","tags":["attack.credential-access","attack.t1558.003"],"technique_ids":["T1558.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/CICADA8-Research/RemoteKrbRelay"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml","source_sha256":"695cb3ea43c5dc99267ebc20f821b16a78719c88e8eb34d5bed08eba01a14b1f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - RemoteKrbRelay Execution\nid: a7664b14-75fb-4a50-a223-cb9bc0afbacf\nstatus: test\ndescription: |\n    Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.\nreferences:\n    - https://github.com/CICADA8-Research/RemoteKrbRelay\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-06-27\ntags:\n    - attack.credential-access\n    - attack.t1558.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\RemoteKrbRelay.exe'\n        - OriginalFileName: 'RemoteKrbRelay.exe'\n    selection_cli_required:\n        CommandLine|contains|all:\n            - ' -clsid '\n            - ' -target '\n            - ' -victim '\n    # selection_cli_attacks:\n    #     # Note: In the current implementation these flags do not require any other flags. Which means they can't be used on their own. They're already covered by \"selection_cli_required\"\n    #     CommandLine|contains:\n    #         - '-adcs ' # relay to HTTP Web Enrollment and get certificate\n    #         - '-laps ' # relay to LDAP and extract LAPS passwords\n    #         - '-ldapwhoami ' # relay to LDAP and get info about relayed user\n    #         - '-shadowcred ' # relay to LDAP and setup Shadow Credentials\n    selection_cli_attack_smb:\n        CommandLine|contains|all:\n            - '-smb ' # relay to SMB\n            - '--smbkeyword '\n        CommandLine|contains:\n            - 'interactive'\n            - 'secrets'\n            - 'service-add'\n    selection_cli_attack_rbcd_main:\n        CommandLine|contains: '-rbcd ' # relay to LDAP and setup RBCD\n    selection_cli_attack_rbcd_options:\n        CommandLine|contains:\n            - '-cn ' # Computer name that will be written to msDs-AllowedToActOnBehalfOfOtherIdentity\n            - '--computername ' # Computer name that will be written to msDs-AllowedToActOnBehalfOfOtherIdentity\n    selection_cli_attack_changepass:\n        CommandLine|contains: '-chp ' # relay to LDAP and change user password\n        CommandLine|contains|all:\n            - '-chpPass ' # new password\n            - '-chpUser ' # the name of the user whose password you want to change\n    selection_cli_attack_addgrpname:\n        CommandLine|contains|all:\n            - '-addgroupmember ' # relay to LDAP and add user to group\n            - '-group '\n            - '-groupuser '\n    condition: selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1558.003","id":"T1558.003","name":"Kerberoasting","page":"techniques/enterprise/T1558.003/"}],"data_path":"data/detection-rules/a7664b14-75fb-4a50-a223-cb9bc0afbacf.json","kind":"sigma"}