1200kmSECURITY RESEARCH

1200KM / sigma-rule

KrbRelayUp Service Installation — Sigma Rule

Sigma rule e97d9903-53b2-41fc-8cb9-889ed4093e80. KrbRelayUp Service Installation — Sigma Rule. Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Rule metadata and linked tags

testhighwindowssystemattack.persistenceattack.privilege-escalationattack.t1543

Author: Sittikorn S, Tim Shelton. Source status: test; severity: high. Source dates: 2022-05-11 / 2022-10-05.

Original logsource
{
  "product": "windows",
  "service": "system"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 1b6a80ea33311fb86631d9b742ec7e453117cfbca3560bdd8109fb323546a719

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

Original Sigma rule YAML, scroll horizontally if needed
title: KrbRelayUp Service Installation
id: e97d9903-53b2-41fc-8cb9-889ed4093e80
status: test
description: Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)
references:
    - https://github.com/Dec0ne/KrbRelayUp
author: Sittikorn S, Tim Shelton
date: 2022-05-11
modified: 2022-10-05
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'KrbSCM'
    condition: selection
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

  • Unknown

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.