Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/KrbRelayUp Attack Pattern

Created May 27, 2022 06:49
Show Gist options
  • Save Shivammalaviya/874620446072408d2a388f9999aaae9b to your computer and use it in GitHub Desktop.
Save Shivammalaviya/874620446072408d2a388f9999aaae9b to your computer and use it in GitHub Desktop.
Download ZIP
Raw
KrbRelayUp Attack Pattern
SecurityEvent
| where (EventID == 4624 and LogonType == "3" and AuthenticationPackageName =~ 'Kerberos'
and IpAddress =~ '127.0.0.1' and TargetUserSid startswith 'S-1-5-21-' and TargetUserSid endswith '-500')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment