updating analytic story name

detections/endpoint/windows_computer_account_created_by_computer_account.yml

@@ -21,7 +21,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
-  - KrbRelayUp
+  - Local Privilege Escalation With KrbRelayUp
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml

@@ -19,7 +19,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
-  - KrbRelayUp
+  - Local Privilege Escalation With KrbRelayUp
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/windows_computer_account_with_spn.yml

@@ -23,7 +23,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
-  - KrbRelayUp
+  - Local Privilege Escalation With KrbRelayUp
   asset_type: Endpoint
   cis20:
   - CIS 3

stories/krbrelayup.yml

@@ -1,18 +0,0 @@
-name: KrbRelayUp
-id: 765790f0-2f8f-4048-8321-fd1928ec2546
-version: 1
-date: '2022-04-28'
-author: Michael Haag, Splunk
-description: KrbRelayUp is a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings).
-narrative: UPDATE_NARRATIVE
-references:
-  - https://github.com/Dec0ne/KrbRelayUp
-tags:
-  analytic_story: KrbRelayUp
-  category:
-  - Privilege Escalation
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Advanced Threat Detection

stories/local_privilege_escalation_with_krbrelayup.yml

@@ -0,0 +1,20 @@
+name: Local Privilege Escalation With KrbRelayUp
+id: 765790f0-2f8f-4048-8321-fd1928ec2546
+version: 1
+date: '2022-04-28'
+author: Michael Haag, Mauricio Velazco, Splunk
+description: KrbRelayUp is a tool that allows local privilege escalation from low-priviliged domain user to local system on domain-joined computers.
+narrative: UPDATE_NARRATIVE
+references:
+  - https://github.com/Dec0ne/KrbRelayUp
+  - https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9
+  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
+tags:
+  analytic_story: Local Privilege Escalation With KrbRelayUp
+  category:
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection