HackTool - KrbRelay Execution
Detects the execution of the KrbRelay tool, a utility used for Kerberos relaying attacks. The rule identifies the tool by its executable name ('KrbRelay.exe') or its original filename, and by specific command-line arguments commonly used by KrbRelay for Kerberos relaying, including parameters related to Service Principal Names (SPN), Class IDs (CLSID), and Resource-Based Constrained Delegation (RBCD) or shadow credentials.
Sigma
