HackTool - KrbRelayUp Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

Detects the execution of KrbRelayUp, a hack tool used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced. The rule identifies the tool by its executable name or original filename and specific command-line arguments associated with its relay, krbscm, and spawn functionalities.