Windows PowerShell ScriptBlock: Rubeus HackTool Execution Flags

title: "Windows PowerShell ScriptBlock: Rubeus HackTool Execution Flags"
id: 0e64ab1b-35a4-49b3-bf7c-022d12799167
related:
  - id: 7ec2c172-dceb-4c10-92c9-87c1881b7e18
    type: similar
  - id: 3245cd30-e015-40ff-a31d-5cadd5f377ec
    type: derived
status: test
description: This rule flags PowerShell ScriptBlock activity containing multiple Rubeus command-line flag patterns associated with Kerberos ticket and hash operations. Attackers can use Rubeus functionality to request, dump, renew, or inject Kerberos artifacts and perform impersonation-related actions. The detection relies on ScriptBlockText content from PowerShell Script Block Logging to match specific keyword and parameter strings.
references:
  - https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus
  - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
  - https://github.com/GhostPack/Rubeus
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml
author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2023-04-27
tags:
  - attack.credential-access
  - attack.t1003
  - attack.t1558.003
  - attack.lateral-movement
  - attack.t1550.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - "asreproast "
      - "dump /service:krbtgt "
      - dump /luid:0x
      - "kerberoast "
      - "createnetonly /program:"
      - "ptt /ticket:"
      - "/impersonateuser:"
      - "renew /ticket:"
      - "asktgt /user:"
      - "harvest /interval:"
      - "s4u /user:"
      - "s4u /ticket:"
      - "hash /password:"
      - "golden /aes256:"
      - "silver /user:"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1