RubeusMalware
Rubeus is a C# toolset for raw Kerberos interaction and abuses.From MISP Galaxy
Last reported 1 month ago, by Google Threat Intelligence6 reports
ATT&CK techniques
6 of 34 · each with the sentence it comes from- T1558.003Kerberoasting
“Kerberoasting | T1558.003 (Kerberoasting) | Suspicious Kerberos Authentication Ticket Request (Custom) | Event ID 4769 with 0x17 (RC4) encryption requested.”
- T1003OS Credential Dumping
“Credential Dump | T1003.006 (OS Credential Dumping) | Potential Remote Credential Access via Registry | Abnormal access to the Security Account Manager (SAM) registry hive.”
- T1003.001LSASS Memory
“You run Impacket's secretsdump to pull hashes from the SAM database and LSASS memory.”
- T1003.006DCSync
“Credential Dump | T1003.006 (OS Credential Dumping) | Potential Remote Credential Access via Registry | Abnormal access to the Security Account Manager (SAM) registry hive.”
- T1036Masquerading
“Masquerading CI/CD Pipeline Tasks as Legitimate AI Utilities”
- T1053.005Scheduled Task
“Persistence | T1053.005 (Scheduled Task) | A scheduled task was created | Event ID 4698 or schtasks.exe /create.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“Research Active Directory post-exploitation methods (e.g., Rubeus Kerberos ticket attacks) to elevate permissions and harvest credentials.”
-
Automating GOAD and Live Malware Labs“Sample Tool: Rubeus or GetUserSPNs.py”
-
DynoWiper update: Technical analysis and attribution“In early stages of the attack, attackers attempted to download the publicly available Rubeus tool.”
-
The OID Problem: Writing LDAP Detections That Actually Work“Attribution through correlation: For tools that use wldap32.dll (like Rubeus and PowerShell's AD module), Event 30 captures OID syntax while Event 1644 captures bitwise syntax.”
-
Recutting the Kerberos Diamond Ticket“Much like an uncut diamond, the PoC in its current state demonstrated in Rubeus”
-
PerfMon! What Is It Good For?“Running a simple Kerberoast attack with Rubeus, with no “opsec” employed, the following results are returned:”
Indicators in its reports
named in the reports above- 31.172.71[.]5in 1 report
- progamevl[.]ruin 1 report
- 472ca448f82a7ff6…86fd7c38b631in 1 report
- 4f8e9336a784a196…8fa54f6a92e2in 1 report
- 4ec3c90846af6b79…3fd21f6d4cf6in 1 report
- 86596a5c5b05a8bf…4702f7d0d61bin 1 report
- 69ede7e341fd26fa…80cb44778d93in 1 report
- 9ec4c38394ea2048…6de48d8bd4e8in 1 report
- 410c8a57fe6e09ed…e4797ca80a19in 1 report
- hxxps://github[.]com/elastic/detection-rulesin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.