Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)
Identifies PowerShell ScriptBlock content that includes Rubeus-specific Kerberos and ticket manipulation flags.
- Product
- windows
- Category
- ps_script
- Author
- Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-27
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell ScriptBlock content that includes command-line style flags associated with the Rubeus Kerberos-focused tool. Attackers use Rubeus to perform credential access and lateral movement actions such as ticket roasting/renewal, impersonation, and pass-the-ticket behavior. Detection relies on Script Block Logging telemetry capturing the executed script text and matching specific flag strings within it.
Reporting behind it
- blog.harmj0y.nethttps://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus
- m0chan.github.iohttps://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
- github.comhttps://github.com/GhostPack/Rubeus
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)
id: 0e64ab1b-35a4-49b3-bf7c-022d12799167
related:
- id: 7ec2c172-dceb-4c10-92c9-87c1881b7e18
type: similar
- id: 3245cd30-e015-40ff-a31d-5cadd5f377ec
type: derived
status: test
description: This rule flags PowerShell ScriptBlock content that includes command-line style flags associated with the Rubeus Kerberos-focused tool. Attackers use Rubeus to perform credential access and lateral movement actions such as ticket roasting/renewal, impersonation, and pass-the-ticket behavior. Detection relies on Script Block Logging telemetry capturing the executed script text and matching specific flag strings within it.
references:
- https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus
- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
- https://github.com/GhostPack/Rubeus
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml
author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2023-04-27
tags:
- attack.credential-access
- attack.t1003
- attack.t1558.003
- attack.lateral-movement
- attack.t1550.003
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- "asreproast "
- "dump /service:krbtgt "
- dump /luid:0x
- "kerberoast "
- "createnetonly /program:"
- "ptt /ticket:"
- "/impersonateuser:"
- "renew /ticket:"
- "asktgt /user:"
- "harvest /interval:"
- "s4u /user:"
- "s4u /ticket:"
- "hash /password:"
- "golden /aes256:"
- "silver /user:"
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1