Detection rules › Splunk
Rubeus Kerberos Ticket Exports Through Winlogon Access
The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1550.003 Use Alternate Authentication Material: Pass the Ticket |
| Lateral Movement | T1550.003 Use Alternate Authentication Material: Pass the Ticket |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 10 | ProcessAccess |
Stages and Predicates
Stage 1: search
search EventCode=10 GrantedAccess=0x1f3fff SourceImage!="C:\\\\Windows\\\\system32\\\\LogonUI.exe" SourceImage!="C:\\\\Windows\\\\system32\\\\lsass.exe" SourceImage!="C:\\\\Windows\\\\system32\\\\smss.exe" SourceImage!="C:\\\\Windows\\\\system32\\\\svchost.exe" SourceImage!="C:\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe" TargetImage="C:\\\\Windows\\\\system32\\\\winlogon.exe"
Stage 2: stats
stats BY CallTrace, EventID, GrantedAccess, Guid, Opcode, ProcessID, SecurityID, SourceImage, SourceProcessGUID, SourceProcessId, TargetImage, TargetProcessGUID, TargetProcessId, UserID, dest, granted_access, parent_process_exec, parent_process_guid, parent_process_id, parent_process_name, parent_process_path, process_exec, process_guid, process_id, process_name, process_path, signature, signature_id, user_id, vendor_product
Stage 3: search
search
Stage 4: search
search
Stage 5: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
GrantedAccess | eq |
|
SourceImage | ne |
|
TargetImage | eq |
|