name: Rubeus Command Line Parameters
id: cca37478-8377-11ec-b59a-acde48001122
version: 1
date: '2022-02-01'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is
  heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin
  project. This analytic looks for the use of Rubeus command line arguments utilized
  in common Kerberos attacks like exporting and importing tickets, forging silver
  and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc.
  Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory
  networks. Defenders should be aware that adversaries may customize the source code
  of Rubeus and modify the command line parameters. This would effectively bypass
  this analytic.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine:
    - '*ptt /ticket*'
    - '* monitor /interval*'
    - '* asktgt* /user:*'
    - '* asktgs* /service:*'
    - '* golden* /user:*'
    - '* silver* /service:*'
    - '* kerberoast*'
    - '* asreproast*'
    - '* renew* /ticket:*'
    - '* brute* /password:*'
    - '* brute* /passwords:*'
    - '* harvest*'
  condition: (selection1)
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA.
known_false_positives: Although unlikely, legitimate applications may use the same
  command line parameters as Rubeus. Filter as needed.
references:
- https://github.com/GhostPack/Rubeus
- https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
- https://attack.mitre.org/techniques/T1550/003/
- https://en.hackndo.com/kerberos-silver-golden-tickets/
tags:
  analytic_story:
  - Active Directory Kerberos Attacks
  asset_type: Endpoint
  confidence: 60
  impact: 60
  message: Rubeus command line parameters were used on $dest$
  mitre_attack_id:
  - T1550
  - T1550.003
  - T1558
  - T1558.003
  - T1558.004
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 36
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog