KrbRelayUp Service Installation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•22

Detects the creation of a Windows service named 'KrbSCM' which is associated with the KrbRelayUp tool. This tool is used for privilege escalation in Windows domain environments where LDAP signing is not enforced, leveraging Kerberos relay attacks.