HackTool - Rubeus Execution

Title: HackTool - Rubeus Execution
Status: stable
Description:Detects the execution of the hacktool Rubeus via PE information of command line parameters
References:
  -https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus
  -https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
  -https://github.com/GhostPack/Rubeus
Author: Florian Roth (Nextron Systems)
Date: 2018-12-19
modified:2023-04-20
Tags:

• -'attack.credential-access'
• -'attack.t1003'
• -'attack.t1558.003'
• -'attack.lateral-movement'
• -'attack.t1550.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\Rubeus.exe' OriginalFileName:'Rubeus.exe' Description:'Rubeus'     - CommandLine|contains:
      - 'asreproast '
      - 'dump /service:krbtgt '
      - 'dump /luid:0x'
      - 'kerberoast '
      - 'createnetonly /program:'
      - 'ptt /ticket:'
      - '/impersonateuser:'
      - 'renew /ticket:'
      - 'asktgt /user:'
      - 'harvest /interval:'
      - 's4u /user:'
      - 's4u /ticket:'
      - 'hash /password:'
      - 'golden /aes256:'
      - 'silver /user:'
  condition:selection
Falsepositives:
  -Unlikely
Level: critical