Sign in Get started

Tool

github.com/Dec0ne/KrbRelayUp

https://github.com/Dec0ne/KrbRelayUp

Published on: github.com
Sources in this catalogue: 3

ATT&CK techniques those detections carry

T1558Steal or Forge Kerberos Tickets
T1543Create or Modify System Process
T1543.003Windows Service
T1548Abuse Elevation Control Mechanism
T1548.002Bypass User Account Control
T1550.003Pass the Ticket
T1557Adversary-in-the-Middle
T1558.003Kerberoasting

Open the original

9 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Windows Kerberos Local Successful Logon	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
Service Creation via Local Kerberos Authentication	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Privilege Escalation via Local Kerberos Relay over LDAP	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Windows KrbRelayUp Service Creation	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Computer Account With SPN	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Computer Account Requesting Kerberos Ticket	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Computer Account Created by Computer Account	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
HackTool - KrbRelayUp Execution	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
KrbRelayUp Service Installation	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 9 of 9

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice