Elastic Defend high stable eql

Potential Credential Access via Rubeus

Identifies the usage of Rubeus using known malicious command line arguments. Rubeus is a toolset used for a diverse set of Kerberos Abuses and Manipulations like renew, ask, extract, and forge Kerberos Tickets.

View Source

Detection Logic

process where event.action == "start" and
  process.command_line : (
    "* asreproast *",
    "* dump /service:krbtgt*",
    "* dump /luid:*",
    "* kerberoast *",
    "* createnetonly /program:*",
    "* ptt /ticket:*",
    "* /impersonateuser:*",
    "* renew /ticket:*",
    "* asktgt /user:*",
    "* asktgs /ticket:*",
    "* harvest /interval:*",
    "* s4u /user:*",
    "* s4u /ticket:*",
    "* hash /password:*",
    "* tgtdeleg",
    "* tgtdeleg /target:*",
    "* golden /des:*",
    "* golden /rc4:*",
    "* golden /aes128:*",
    "* golden /aes256:*",
    "* changpw /ticket:*"
  )

Field Validations

Loading…

Comments (0)

Loading comments...