HackTool - KrbRelay Execution

Title: HackTool - KrbRelay Execution
Status: test
Description:Detects the use of KrbRelay, a Kerberos relaying tool
References:
  -https://github.com/cube0x0/KrbRelay
Author: Florian Roth (Nextron Systems)
Date: 2022-04-27
modified:2023-02-04
Tags:

• -'attack.credential-access'
• -'attack.t1558.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\KrbRelay.exe' OriginalFileName:'KrbRelay.exe'   selection_cli_1:
    CommandLine|contains|all:
      -' -spn '
      -' -clsid '
      -' -rbcd '

  selection_cli_2:
    CommandLine|contains|all:
      -'shadowcred'
      -'clsid'
      -'spn'

  selection_cli_3:
    CommandLine|contains|all:
      -'spn '
      -'session '
      -'clsid '

  condition:1 of selection_*
Falsepositives:
  -Unlikely
Level: high