HackTool - Rubeus Execution - ScriptBlock

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•30

Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.