RemoteKrbRelay Execution Detection
Detects the execution of RemoteKrbRelay, a tool used for Kerberos relaying attacks. The rule identifies the tool based on its executable name or original filename and various command-line arguments that indicate different Kerberos relaying attack techniques such as relaying to SMB, LDAP for RBCD (Resource-Based Constrained Delegation), changing user passwords, or adding users to groups.
Sigma
