KrbRelayUp Service Installation

Title: KrbRelayUp Service Installation
Status: test
Description:Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)
References:
  -https://github.com/Dec0ne/KrbRelayUp
Author: Sittikorn S, Tim Shelton
Date: 2022-05-11
modified:2022-10-05
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1543'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    EventID: '7045'
    ServiceName: 'KrbSCM'
  condition:selection
Falsepositives:
  -Unknown
Level: high