HackTool - Rubeus Execution

Severity: critical
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects the execution of the hacktool Rubeus via PE information of command line parameters

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1550.003` Use Alternate Authentication Material: Pass the Ticket
Credential Access	`T1003` OS Credential Dumping, `T1558.003` Steal or Forge Kerberos Tickets: Kerberoasting
Lateral Movement	`T1550.003` Use Alternate Authentication Material: Pass the Ticket

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `selection`

or:
CommandLine|contains: '/impersonateuser:'
CommandLine|contains: 'asktgt /user:'
CommandLine|contains: 'asreproast '
CommandLine|contains: 'createnetonly /program:'
CommandLine|contains: 'dump /luid:0x'
CommandLine|contains: 'dump /service:krbtgt '
CommandLine|contains: 'golden /aes256:'
CommandLine|contains: 'harvest /interval:'
CommandLine|contains: 'hash /password:'
CommandLine|contains: 'kerberoast '
CommandLine|contains: 'ptt /ticket:'
CommandLine|contains: 'renew /ticket:'
CommandLine|contains: 's4u /ticket:'
CommandLine|contains: 's4u /user:'
CommandLine|contains: 'silver /user:'
Description: Rubeus
Image|endswith: '\Rubeus.exe'
OriginalFileName: Rubeus.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.