Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/KrbRelayUp Hack Tool

Last active May 27, 2022 06:48
Show Gist options
  • Save Shivammalaviya/c644543b9499b0f27615514ca86346df to your computer and use it in GitHub Desktop.
Save Shivammalaviya/c644543b9499b0f27615514ca86346df to your computer and use it in GitHub Desktop.
Download ZIP
Raw
KrbRelayUp Hack Tool
SecurityEvent
| where EventID == 1
| where (NewProcessName endswith @'\KrbRelayUp.exe' or OriginalFilename =~ 'KrbRelayUp.exe'
or (CommandLine contains ' relay ' and CommandLine contains ' -Domain ' and CommandLine contains ' -ComputerName ')
or (CommandLine contains ' krbscm ' and CommandLine contains ' -sc ') or (CommandLine contains ' spawn '
and CommandLine contains ' -d ' and CommandLine contains ' -cn ' and CommandLine contains ' -cp '))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment