diff --git a/detections/endpoint/windows_computer_account_created_by_computer_account.yml b/detections/endpoint/windows_computer_account_created_by_computer_account.yml
index f50f235612..a0fc87e26b 100644
--- a/detections/endpoint/windows_computer_account_created_by_computer_account.yml
+++ b/detections/endpoint/windows_computer_account_created_by_computer_account.yml
@@ -21,7 +21,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
-  - KrbRelayUp
+  - Local Privilege Escalation With KrbRelayUp
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml
index 317aa90198..3eb02b7c46 100644
--- a/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml
+++ b/detections/endpoint/windows_computer_account_requesting_kerberos_ticket.yml
@@ -19,7 +19,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
-  - KrbRelayUp
+  - Local Privilege Escalation With KrbRelayUp
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/windows_computer_account_with_spn.yml b/detections/endpoint/windows_computer_account_with_spn.yml
index bf89386206..8679cae67f 100644
--- a/detections/endpoint/windows_computer_account_with_spn.yml
+++ b/detections/endpoint/windows_computer_account_with_spn.yml
@@ -23,7 +23,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
-  - KrbRelayUp
+  - Local Privilege Escalation With KrbRelayUp
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/stories/krbrelayup.yml b/stories/krbrelayup.yml
deleted file mode 100644
index 810d7ac0bf..0000000000
--- a/stories/krbrelayup.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: KrbRelayUp
-id: 765790f0-2f8f-4048-8321-fd1928ec2546
-version: 1
-date: '2022-04-28'
-author: Michael Haag, Splunk
-description: KrbRelayUp is a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings).
-narrative: UPDATE_NARRATIVE
-references:
-  - https://github.com/Dec0ne/KrbRelayUp
-tags:
-  analytic_story: KrbRelayUp
-  category:
-  - Privilege Escalation
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Advanced Threat Detection
diff --git a/stories/local_privilege_escalation_with_krbrelayup.yml b/stories/local_privilege_escalation_with_krbrelayup.yml
new file mode 100644
index 0000000000..3f8894c95f
--- /dev/null
+++ b/stories/local_privilege_escalation_with_krbrelayup.yml
@@ -0,0 +1,20 @@
+name: Local Privilege Escalation With KrbRelayUp
+id: 765790f0-2f8f-4048-8321-fd1928ec2546
+version: 1
+date: '2022-04-28'
+author: Michael Haag, Mauricio Velazco, Splunk
+description: KrbRelayUp is a tool that allows local privilege escalation from low-priviliged domain user to local system on domain-joined computers.
+narrative: UPDATE_NARRATIVE
+references:
+  - https://github.com/Dec0ne/KrbRelayUp
+  - https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9
+  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
+tags:
+  analytic_story: Local Privilege Escalation With KrbRelayUp
+  category:
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection