Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
15
12
9
5
1
Contributors
10
9
7
5
4
Categories
39
28
26
7
5
Platforms
42
1
1
Products / Services
18
16
12
8
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
2
1
This rule detects the execution of the Rubeus tool or the usage of common command-line arguments associated with Kerberoasting activities (e.g., GetUserSPNs, Request-SPNTicket). Kerberoasting is a technique used to extract service account password hashes from Active Directory by requesting service tickets for accounts with Service Principal Names (SPNs). These hashes can then be cracked offline to obtain cleartext credentials.
This rule detects potential AS-REP Roasting activities by monitoring process creations for the Rubeus toolset (using the asreproast command) and PowerShell scripts executing commands related to AS-REP Roasting (Get-ASREPHash or asreproast). This technique is used by adversaries to extract Kerberos TGTs for accounts with Kerberos pre-authentication disabled, allowing for offline password cracking.
Detects the execution of known Kerberoasting tools or commands, specifically identifying the use of Rubeus, GetUserSPNs, or processes containing strings related to Kerberoasting, which indicates attempts to extract Kerberos service tickets for offline brute-force attacks.
Detects Pass-the-Ticket attacks using stolen Kerberos tickets
Detects Kerberoasting via service ticket enumeration tools
Detects download of known offensive security and post-exploitation tools
Detects download of known offensive security tools for capability acquisition
This rule detects suspicious user-agent strings in Microsoft Graph activity logs that are commonly associated with reconnaissance and attack tools targeting Azure AD and Microsoft 365 environments. These tools include BloodHound, ROADtools, AADInternals, and various other utilities used for enumeration, credential spraying, and other malicious activities.
Detects suspicious process creation activities executed by the SYSTEM user, specifically looking for known malicious programs or command-line parameters often associated with credential dumping, defense evasion, and privilege escalation techniques. This includes the use of tools like Mimikatz, Rubeus, ProcDump, and various PowerShell obfuscation methods, as well as commands related to shadow copy deletion and registry hive saving.
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
Detects the execution of the hacktool Rubeus via PE information or command line parameters. Rubeus is a C# toolset designed for raw Kerberos interaction, often used for credential access, Kerberoasting, and pass-the-ticket attacks.
This rule detects failed attempts by a user or process to call the 'LsaRegisterLogonProcess' function. This function requires the 'SeTcbPrivilege' privilege, which is typically held by legitimate logon processes. A failure to call this function, especially when combined with the '0x8010000000000000' keyword indicating a failure, could suggest an attacker (e.g., using tools like Rubeus) is attempting to interact with the Local Security Authority (LSA) to gain unauthorized access to credentials or perform other malicious activities. The rule specifically looks for Event ID 4673 (A privileged service was called) where the service is 'LsaRegisterLogonProcess()' and the operation failed.
Detects the execution of PowerShell commandlets commonly associated with well-known PowerShell exploitation frameworks and tools. This rule identifies specific commandlet names within process command lines, indicating potential malicious activity such as credential dumping, reconnaissance, privilege escalation, persistence, and lateral movement.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
Roasting
KQL
Detect Active Directory LDAP queries that search for Kerberoasting (SPNs) or accounts with Kerberos preauthentication not required from Azure ATP, and try to get the process initiated the LDAP query from MDATP.
Replace 389 on line 5 with LDAP port in your environment
Replace true on line 6 to false if you want to include Nt Authority process
This LDAP query cover Rubeus, Kerberoast, BloodHound tools
Replace 389 on line 5 with LDAP port in your environment
Replace true on line 6 to false if you want to include Nt Authority process
This LDAP query cover Rubeus, Kerberoast, BloodHound tools
// Detect multiple sensitive Active Directory LDAP queries made in bin time
// Sensitive queries defined as Roasting or sensitive objects queries
// Replace 10 on line 6 with your desired thershold
// Replace 1m on line 7 with your desired bin time
// This LDAP query cover Rubeus, Kerberoast, BloodHound tools
// Sensitive queries defined as Roasting or sensitive objects queries
// Replace 10 on line 6 with your desired thershold
// Replace 1m on line 7 with your desired bin time
// This LDAP query cover Rubeus, Kerberoast, BloodHound tools
The analytic detects a suspicious Kerberos Ticket Granting Ticket (TGT) request, identified by Event Code 4768. This detection leverages Windows Security Event Logs to identify TGT requests with unusual fields, specifically a non-empty CertThumbprint, which may indicate the use of tools like Rubeus following the exploitation of CVE-2021-36942 (PetitPotam). This activity is significant as it can signal an attacker leveraging a compromised certificate to request Kerberos tickets, potentially leading to unauthorized access. If confirmed malicious, this could allow attackers to escalate privileges and persist within the environment, posing a severe security risk.
The analytic detects the use of Rubeus command line parameters, a toolset for Kerberos attacks within Active Directory environments. It leverages Endpoint Detection and Response (EDR) data to identify specific command-line arguments associated with actions like ticket manipulation, kerberoasting, and password spraying. This activity is significant as Rubeus is commonly used by adversaries to exploit Kerberos for privilege escalation and lateral movement. If confirmed malicious, this could lead to unauthorized access, persistence, and potential compromise of sensitive information within the network.
The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk.
Detects the potential use of Rubeus by identifying the registration of a new trusted logon process. This activity is often associated with Kerberos-related attacks, where Rubeus is used to manipulate Kerberos tickets or processes for privilege escalation or lateral movement.
Page 2 of 3