Detectionhightest

HackTool - Rubeus Execution - ScriptBlock

Detects the execution of the hacktool Rubeus using specific command line flags

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)Created Thu Apr 273245cd30-e015-40ff-a31d-5cadd5f377ecwindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection:
        ScriptBlockText|contains:
            - 'asreproast '
            - 'dump /service:krbtgt '
            - 'dump /luid:0x'
            - 'kerberoast '
            - 'createnetonly /program:'
            - 'ptt /ticket:'
            - '/impersonateuser:'
            - 'renew /ticket:'
            - 'asktgt /user:'
            - 'harvest /interval:'
            - 's4u /user:'
            - 's4u /ticket:'
            - 'hash /password:'
            - 'golden /aes256:'
            - 'silver /user:'
    condition: selection