Rubeus Execution for Kerberoasting or Ticket Forgery

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•4

This rule detects the execution of the Rubeus tool, a known C# toolkit for raw Kerberos interaction. The rule specifically alerts on command-line arguments associated with common Kerberos attacks such as Kerberoasting, requesting TGT/TGS tickets, and performing Pass-the-Ticket operations.