Rubeus S1071

Type: tool
Platform: Windows
Created: 29 March 2023
Last modified: 12 May 2026

Rubeus is a C# toolset designed for raw Kerberos interaction that has been used since at least 2020, including in ransomware operations.[1][2][3][4]

TechniquesBottom 23%

TacticsBottom 12%

Threat groupunranked

Campaignsunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Rubeus MITRE reference S1071

Domain Trust Discovery T1482 ↗

Rubeus can gather information about domain trusts.5 6

Discovery31 detection rules

Golden Ticket T1558.001 ↗

Rubeus can forge a ticket-granting ticket.7

Credential Access2 detection rules

Silver Ticket T1558.002 ↗

Rubeus can create silver tickets.8

Credential Access1 detection rules

Kerberoasting T1558.003 ↗

Rubeus can use the KerberosRequestorSecurityToken.GetRequest method to request kerberoastable service tickets.9

Credential Access27 detection rules

AS-REP Roasting T1558.004 ↗

Rubeus can reveal the credentials of accounts that have Kerberos pre-authentication disabled through AS-REP roasting.10 11 12

Credential Access6 detection rules

Standing S1071

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques5Bottom 23%

23rd percentile · 77% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics2Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns285% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique6medBottom 8%

8th percentile · 92% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique3med

Rubeus detections S1071

65 distinct rules cover the 5 techniques recorded for this tool. 37 Sigma · 28 Splunk.

5 covered by at least one rule65 distinct rules in total

Showing 1-50 of 65 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects a Domain Controller machine account authenticating from a source IP that is not a known Doma (...)	Placeholder	experimental	authentication	windows	WinEventLog Security	Credential Access Steal or Forge Authentication Certificates Credential Access Steal or Forge Kerberos Tickets Silver Ticket Lateral Movement Use Alternate Authentication Material Pass the Ticket	CVE-2026-54121	critical	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-29	—	b2e4a719-3c8f-4d1b-a507-f83c2d56e901
	Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller machine account (...)	Placeholder	experimental	authentication	windows	WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Kerberoasting Lateral Movement Use Alternate Authentication Material Pass the Ticket	CVE-2026-54121	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-29	—	e3f7c841-2a9d-4b5e-c018-d94b3e67f012
	Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account originatin (...)	Placeholder	experimental	authentication	windows	WinEventLog Security	Credential Access Steal or Forge Authentication Certificates Credential Access Steal or Forge Kerberos Tickets Golden Ticket Lateral Movement Use Alternate Authentication Material Pass the Ticket	CVE-2026-54121	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-29	—	9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
Splunk	The following analytic detects the execution of the `Get-ADUser` PowerShell cmdlet with parameters indicating a search for domain accounts with Kerberos Pre-Authentication disabled. (...)	Generic	stable	ps_script	windows	PowerShell	Credential Access Steal or Forge Kerberos Tickets AS-REP Roasting	-	medium	Mauricio Velazco, Splunk	2022-02-18	2026-05-13	114c6bfe-9406-11ec-bcce-acde48001122
Splunk	The following analytic detects the execution of the `Get-DomainUser` commandlet with the `-PreauthNotRequired` parameter using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Credential Access Steal or Forge Kerberos Tickets AS-REP Roasting	-	medium	Mauricio Velazco, Splunk	2022-02-18	2026-05-13	b0b34e2c-90de-11ec-baeb-acde48001122
	Detects DNS server discovery via LDAP query requests from uncommon applications	Generic	test	dns	windows	Sysmon	Discovery Domain Trust Discovery	-	low	frack113	2022-08-20	2023-09-18	a21bcd7e-38ec-49ad-b69a-9ea17e69509e
	Detects execution of "dsquery.exe" for domain trust discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery	-	medium	E.M. Anhaus, Tony Lambert, oscd.community, omkar72	2019-10-24	2023-02-02	3bad990e-4848-4a78-9530-b427d854aac0
Splunk	The following analytic detects the execution of "dsquery.exe" with arguments targeting `TrustedDomain` queries directly from the command line. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-03-31	2026-10-02	cc316032-924a-11eb-91a2-acde48001122
Splunk	The following analytic identifies the execution of the Get-DomainTrust command from PowerView using PowerShell, which is used to gather domain trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-10-02	4fa7f846-054a-11ec-a836-acde48001122
Splunk	The following analytic detects the execution of the Get-DomainTrust command from PowerView using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	89275e7e-0548-11ec-bf75-acde48001122
Splunk	The following analytic detects the execution of the Get-ForestTrust command via PowerShell, commonly used by adversaries to gather domain trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-10-02	584f4884-0bf1-11ec-a5ec-acde48001122
Splunk	The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	70fac80e-0bf1-11ec-9ba0-acde48001122
	Detects command line parameters used by Bloodhound and Sharphound hack tools	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	Florian Roth (Nextron Systems)	2019-12-20	2023-02-04	f376c8a7-a2d0-4ddc-aa0c-16c17236d962
	Detects the use of KrbRelay, a Kerberos relaying tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	-	high	Florian Roth (Nextron Systems)	2022-04-27	2023-02-04	e96253b8-6b3b-4f90-9e59-3b24b99cf9b4
	Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain e (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Kerberoasting Lateral Movement Use Alternate Authentication Material Pass the Ticket	-	high	Florian Roth (Nextron Systems)	2022-04-26	2023-02-04	12827a56-61a4-476a-a9cb-f3068f191073
	Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	-	high	Nasreddine Bencherchali (Nextron Systems)	2024-06-27	—	a7664b14-75fb-4a50-a223-cb9bc0afbacf
	Detects the execution of the hacktool Rubeus via PE information of command line parameters	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping Credential Access Steal or Forge Kerberos Tickets Kerberoasting Lateral Movement Use Alternate Authentication Material Pass the Ticket	-	critical	Florian Roth (Nextron Systems)	2018-12-19	2023-04-20	7ec2c172-dceb-4c10-92c9-87c1881b7e18
	Detects the execution of the hacktool Rubeus using specific command line flags	Generic	test	ps_script	windows	PowerShell	Credential Access OS Credential Dumping Credential Access Steal or Forge Kerberos Tickets Kerberoasting Lateral Movement Use Alternate Authentication Material Pass the Ticket	-	high	Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)	2023-04-27	—	3245cd30-e015-40ff-a31d-5cadd5f377ec
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Network Share Discovery Discovery Permission Groups Discovery Domain Groups Discovery System Network Connections Discovery Discovery System Owner/User Discovery	-	high	frack113	2021-12-10	2023-02-14	b2317cfa-4a47-4ead-b3ff-297438c0bc2d
	Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery	-	high	frack113	2022-08-20	2023-02-13	69ca006d-b9a9-47f5-80ff-ecd4d25d481a
	This rule will collect the data needed to start looking into possible kerberoasting activity. (...)	Generic	test	authentication	windows	WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	-	medium	@kostastsale	2022-01-21	2025-10-19	d04ae2b8-ad54-4de0-bd87-4bc1da66aa59
Splunk	The following analytic detects potential Kerberoasting attacks by identifying Kerberos service ticket requests with RC4 encryption through Event ID 4769. (...)	Generic	stable	authentication	windows	WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	-	medium	Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Dean Luxton, Splunk	2020-06-11	2026-10-02	5cc67381-44fa-4111-8a37-7a230943f027
	Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting	Generic	test	-	-	Kerberos · Zeek	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	-	medium	sigma	2020-02-12	2021-11-27	503fe26e-b5f2-4944-a126-eab405cc06e5
Splunk	The following analytic detects when the Kerberos Pre-Authentication flag is disabled in a user account, using Windows Security Event 4738. (...)	Generic	stable	account_management	windows	WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets AS-REP Roasting	-	medium	Mauricio Velazco, Splunk	2022-02-23	2026-05-13	0cb847ee-9423-11ec-b2df-acde48001122
Splunk	The following analytic detects the use of the `Set-ADAccountControl` PowerShell cmdlet with parameters that disable Kerberos Pre-Authentication. (...)	Generic	stable	ps_script	windows	PowerShell	Credential Access Steal or Forge Kerberos Tickets AS-REP Roasting	-	medium	Mauricio Velazco, Splunk	2022-02-23	2026-05-13	59b51620-94c9-11ec-b3d5-acde48001122
Splunk	The following analytic detects Kerberos service ticket requests using RC4 encryption, leveraging Kerberos Event 4769. (...)	Generic	stable	authentication	windows	WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Golden Ticket	-	medium	Mauricio Velazco, Splunk	2022-03-15	2026-05-13	7d90f334-a482-11ec-908c-acde48001122
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_module	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-20	2025-12-10	7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-02	2025-12-10	02030f2f-6199-49ec-b258-ea71b07e03dc
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer	2017-03-05	2025-12-10	89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
Splunk	The following analytic identifies network traffic directed to the Active Directory Web Services Protocol (ADWS) on port 9389. (...)	Hunting	stable	network_connection	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2024-02-14	2026-05-13	68a0056c-34cb-455f-b03d-df935ea62c4f
Splunk	The following analytic identifies the execution of `nltest.exe` with command-line arguments `/domain_trusts` or `/all_trusts` to query Domain Trust information. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-01-25	2026-10-02	c3e05466-5f22-11eb-ae93-0242ac130002
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Remote System Discovery Discovery System Network Configuration Discovery	-	low	Arun Chauhan	2023-02-03	—	903076ff-f442-475a-b667-4f246bcc203b
	Detects errors when a target server doesn't have suitable keys for generating kerberos tickets. (...)	Generic	test	-	windows	WinEventLog System	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	-	low	@SerkinValery	2024-03-07	2025-09-22	b1e0b3f5-b62e-41be-886a-daffde446ad4
	Detects potential Active Directory enumeration via LDAP	Generic	test	-	windows	LDAP	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Adeem Mawani	2021-06-22	2025-07-04	31d68132-4038-47c7-8f8e-635a39a7c174
	The attacker creates a computer object using those permissions with a password known to her. (...)	Emerging	test	-	windows	WinEventLog System	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	CVE-2021-42278	medium	frack113	2021-12-15	2023-04-14	44bbff3e-4ca3-452d-a49a-6efa4cafa06f
	The attacker creates a computer object using those permissions with a password known to her. (...)	Emerging	test	-	windows	WinEventLog System	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	CVE-2021-42287	medium	frack113	2021-12-15	2023-04-14	e80a0fee-1a62-4419-b31e-0d0db6e6013a
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery System Network Configuration Discovery	-	medium	Craig Young, oscd.community, Georg Lauenstein	2021-07-24	2023-12-15	5cc90652-4cbd-4241-aa3b-4b462fa5a248
	Detects service principal name (SPN) enumeration used for Kerberoasting	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	-	medium	Markus Neis, keepwatch	2018-11-14	2023-10-23	1eeed653-dbc8-4187-ad0c-eeebb20e6599
	Detects AdFind execution with common flags seen used during attacks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community	2021-02-02	2025-10-24	9a132afa-654e-11eb-ae93-0242ac130002
	Detects potential use of Rubeus via registered new trusted logon process	Generic	test	-	windows	WinEventLog Security	Credential Access Steal or Forge Kerberos Tickets Kerberoasting	-	high	Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community	2019-10-24	2022-10-09	12e6d621-194f-4f59-90cc-1959e21e69f7
	Detects the use of a renamed Adfind.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Florian Roth (Nextron Systems)	2022-08-21	2025-02-26	df55196f-f105-44d3-a675-e9dfb6cc2f2b
Splunk	The following analytic detects the use of Rubeus command line parameters, a toolset for Kerberos attacks within Active Directory environments. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Credential Access Steal or Forge Kerberos Tickets Kerberoasting AS-REP Roasting Lateral Movement Use Alternate Authentication Material Pass the Ticket	-	medium	Mauricio Velazco, Splunk	2022-02-07	2026-05-13	cca37478-8377-11ec-b59a-acde48001122