Rubeus or Mimikatz Kerberos Attack Detection

nomit vyas@xoxo

•updated Jun 24, 2026•3•0•10

Detects the execution of Rubeus or Mimikatz with command-line arguments indicative of Kerberos attacks such as Pass the Ticket (PtT) or Golden Ticket generation. This rule specifically looks for keywords like 'rubeus ptt', 'kerberos::ptt', 'kerberos::golden', and 'mimikatz kerberos' in process command lines.