Windows KrbRelayUp Service Creation

This analytic detects the creation of a Windows service named "KrbSCM" which is associated with the KrbRelayUp tool. KrbRelayUp is known for its use in privilege escalation attacks. The detection relies on Windows System Event Log EventCode 7045, which logs service creation events. Identifying this activity is crucial as it indicates a potential privilege escalation attempt that could lead to unauthorized access to sensitive systems and data.