Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/KrbRelayUp EQL Winlog

Created April 26, 2022 16:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/165cc8192333972397d067c726b2165b to your computer and use it in GitHub Desktop.
Save Samirbous/165cc8192333972397d067c726b2165b to your computer and use it in GitHub Desktop.
Download ZIP
Raw
KrbRelayUp EQL Winlog
sequence by host.id with maxspan=5m
[authentication where
/* event 4624 need to be logged */
event.action == "logged-in" and event.outcome == "success" and
/* authenticate locally using relayed kerberos TGS */
winlog.event_data.AuthenticationPackageName :"Kerberos" and winlog.logon.type == "Network" and
source.ip == "127.0.0.1" and source.port > 0 and
/* Impersonate Administrator user via S4U2Self */
winlog.event_data.TargetUserSid : "S-1-5-21-*-500"] by winlog.event_data.TargetLogonId
[any where event.code : "4697"] by winlog.event_data.SubjectLogonId
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment