Potential Kerberos Relaying Activity - MDE

Time window: 20s
Group by: DeviceId, DeviceName
Author: Cyb3rMonk
Source: github.com/Cyb3r-Monk/Threat-Hunting-and-Detection

The below query detects potential Kerberos relaying event chain generated by KrbRelay.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	No specific technique

References

https://github.com/cube0x0/KrbRelay

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceEvents` action `any`: Defender event
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ConnectionSuccess`: Connection succeeded
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ListeningConnectionCreated`: Listening connection created
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `any`: Network activity
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `ProcessCreated`: Process created
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

// Author       : Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://mergene.medium.com)
//
// Link to original post:
// https://posts.bluraven.io/detecting-kerberos-relaying-e6be66fa647c
//
// Description: This query detects potential Kerberos relaying event chain generated by KrbRelay(https://github.com/cube0x0/KrbRelay).
//
// Query parameters:
//
union DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents
| where Timestamp > ago(60m)
| extend PipeName_ = tostring(todynamic(AdditionalFields).PipeName)
| extend Action = case(
    (ActionType=="ConnectionSuccess" and RemotePort in (389, 636)), 'ConnectToDC', 
    (ActionType=="ListeningConnectionCreated"), 'ListeningConnectionCreated', 
    (ActionType=="NamedPipeEvent" and PipeName_ has @"Winsock2\CatalogChangeListener"), 'NamedPipeEvent',
    (ActionType=="ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p"), 'DcomProcessCreated',
    (ActionType=="ConnectionSuccess" and LocalIP==RemoteIP and InitiatingProcessParentFileName=="svchost.exe"), 'DcomProcessConnecToSelf', 'Other'
    )
| summarize Actions = make_set_if(Action, Action <> "Other") by DeviceId, DeviceName, bin(Timestamp,20s)
| where array_length(Actions)==5
| project-rename ActivityTimestamp = Timestamp
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(60m)
    | where ActionType=="ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p"
    ) on DeviceId
    | where abs(datetime_diff('second', Timestamp, ActivityTimestamp)) <=20

union DeviceProcessEvents, DeviceEvents, DeviceNetworkEvents
| where Timestamp > ago(60m)
| extend PipeName_ = tostring(todynamic(AdditionalFields).PipeName)
| where 
    (ActionType=="ConnectionSuccess" and RemotePort in (389, 636)) or 
    (ActionType=="ListeningConnectionCreated") or 
    (ActionType=="NamedPipeEvent" and PipeName_ has @"Winsock2\CatalogChangeListener") or
    (ActionType=="ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p") or
    (ActionType=="ConnectionSuccess" and LocalIP==RemoteIP and InitiatingProcessParentFileName=="svchost.exe")
    | sort by Timestamp desc

Stages and Predicates

Stage 1: `union`

union of 3 branches

Stage 2: `source`

DeviceProcessEvents

Stage 3: `source`

DeviceEvents

Stage 4: `source`

DeviceNetworkEvents

Stage 5: `where`

where Timestamp > ago(3600s)

Stage 6: `extend`

extend PipeName_

Stage 7: `extend`

extend Action

Action =

ifActionType == "ConnectionSuccess" and RemotePort in (389, 636)'ConnectToDC'

elifActionType == "ListeningConnectionCreated"'ListeningConnectionCreated'

elifActionType == "NamedPipeEvent" and PipeName_ has @"Winsock2\CatalogChangeListener"'NamedPipeEvent'

elifActionType == "ProcessCreated" and InitiatingProcessCommandLine == "svchost.exe -k DcomLaunch -p"'DcomProcessCreated'

elif(ActionType == "ConnectionSuccess" and LocalIP =~ RemoteIP) and InitiatingProcessParentFileName == "svchost.exe"'DcomProcessConnecToSelf'

else'Other'

Stage 8: `summarize`

summarize Actions by DeviceId, DeviceName

Stage 9: `where`

where Actions == 5

Stage 10: `project-rename`

project-rename

Stage 11: `join`

join kind=inner (DeviceProcessEvents) on DeviceId

Stage 12: `where`

where /* macro: (abs(datetime_diff('second', Timestamp, ActivityTimestamp)) <= 20) */

Stage 13: `union`

union of 3 branches

Stage 14: `source`

DeviceProcessEvents

Stage 15: `source`

DeviceEvents

Stage 16: `source`

DeviceNetworkEvents

Stage 17: `where`

where Timestamp > ago(3600s)

Stage 18: `extend`

extend PipeName_

Stage 19: `where`

where ((ActionType =~ "ConnectionSuccess" and InitiatingProcessParentFileName =~ "svchost.exe" and LocalIP =~ RemoteIP) or (ActionType =~ "ConnectionSuccess" and RemotePort in~ (389, 636)) or (ActionType =~ "NamedPipeEvent" and PipeName_ contains @"Winsock2\CatalogChangeListener") or (ActionType =~ "ProcessCreated" and InitiatingProcessCommandLine =~ "svchost.exe -k DcomLaunch -p") or ActionType =~ "ListeningConnectionCreated")

Stage 20: `sort`

sort by Timestamp

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`ConnectionSuccess` `ListeningConnectionCreated` `NamedPipeEvent` `ProcessCreated`	`field:"ActionType" kind:eq`
`InitiatingProcessCommandLine`	eq	`svchost.exe -k DcomLaunch -p`	`field:"ParentCommandLine" kind:eq value:"svchost.exe -k DcomLaunch -p"`
`InitiatingProcessParentFileName`	eq	`svchost.exe`	`field:"GrandParentImage" kind:eq value:"svchost.exe"`
`LocalIP`	cross_field_compare	`RemoteIP` transforms: `op:eq`	`field:"src_ip" kind:cross_field_compare value:"RemoteIP"`
`PipeName_`	match	`Winsock2\CatalogChangeListener` transforms: `term`	`field:"PipeName_" kind:match value:"Winsock2\CatalogChangeListener"`
`RemotePort`	in	`389` `636`	`field:"DestinationPort" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Actions`	`summarize`
`DeviceId`	`summarize`
`DeviceName`	`summarize`
`ActivityTimestamp`	`project-rename`

Potential Kerberos Relaying Activity - MDE

MITRE ATT&CK coverage

References

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: union

Stage 2: source

Stage 3: source

Stage 4: source

Stage 5: where

Stage 6: extend

Stage 7: extend

Stage 8: summarize

Stage 9: where

Stage 10: project-rename

Stage 11: join

Stage 12: where

Stage 13: union

Stage 14: source

Stage 15: source

Stage 16: source

Stage 17: where

Stage 18: extend

Stage 19: where

Stage 20: sort