Rubeus

S1071

About this tool

Rubeus is a C# toolset designed for raw Kerberos interaction that has been used since at least 2020, including in ransomware operations.

Technique	Procedure example
T1482 Domain Trust Discovery	Rubeus can gather information about domain trusts. DFIR Ryuk 2 Hour Speed Run November 2020 DFIR Ryuk's Return October 2020
T1558.001 Golden Ticket	Rubeus can forge a ticket-granting ticket. GitHub Rubeus March 2023
T1558.002 Silver Ticket	Rubeus can create silver tickets. GitHub Rubeus March 2023
T1558.003 Kerberoasting	Rubeus can use the `KerberosRequestorSecurityToken.GetRequest` method to request kerberoastable service tickets. GitHub Rubeus March 2023
T1558.004 AS-REP Roasting	Rubeus can reveal the credentials of accounts that have Kerberos pre-authentication disabled through AS-REP roasting. DFIR Ryuk 2 Hour Speed Run November 2020 DFIR Ryuk's Return October 2020 GitHub Rubeus March 2023

DFIR Ryuk 2 Hour Speed Run November 2020 Open source
The DFIR Report. (2020, November 5). Ryuk Speed Run, 2 Hours to Ransom. Retrieved November 6, 2020.
DFIR Ryuk's Return October 2020 Open source
The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.
FireEye KEGTAP SINGLEMALT October 2020 Open source
Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.
GitHub Rubeus March 2023 Open source
Harmj0y. (n.d.). Rubeus. Retrieved March 29, 2023.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.