Detects the execution of the hacktool Rubeus using specific command line flags

Detects the execution of the hacktool Rubeus via PE information of command line parameters

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Detects service principal name (SPN) enumeration used for Kerberoasting

Detects the use of KrbRelay, a Kerberos relaying tool

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced

Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Detects service ticket requests using RC4 encryption type

utilize native PowerShell Identity modules to query the domain to extract the Service Principal Names for a single computer. This behavior is typically used during a kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.

Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

Detects potential use of Rubeus via registered new trusted logon process