Detection of Rubeus Kerberos Ticket Extraction via Winlogon Access

The Rubeus tool is frequently utilized by threat actors to perform advanced Kerberos attacks, including the extraction of Kerberos tickets (TGTs) from memory. A common, albeit suspicious, technique for achieving this involves requesting handle access to the winlogon.exe process. By obtaining full access rights (specifically the legacy access mask 0x1f3fff) to this process, unauthorized tools can facilitate credential harvesting and potentially enable further lateral movement or privilege escalation within an Active Directory environment. Defenders can monitor for this activity by analyzing Sysmon EventCode 10 logs for cross-process requests that target winlogon.exe with these specific access rights. This activity is a key indicator of credential theft attempts and is often associated with the early stages of post-compromise activity or ransomware deployment.

Attack Chain

1. The adversary establishes initial access on a Windows endpoint.
2. The adversary deploys the Rubeus utility or a similar custom tool to the compromised host.
3. The malicious process identifies the winlogon.exe process handle for targeting.
4. The malicious process invokes Windows APIs (e.g., OpenProcess) to request cross-process access.
5. The request uses the full-access mask 0x1f3fff to open a handle to winlogon.exe.
6. The adversary leverages the handle to perform memory injection or extraction of Kerberos ticket data.
7. Extracted TGTs are offloaded or used locally to perform Pass-the-Ticket or other Kerberos-based attacks.

Impact

Successful execution of this technique allows an attacker to steal Kerberos tickets from memory, enabling unauthorized access to network services and lateral movement. This activity has been observed in various campaigns involving ransomware (such as BlackSuit) and wiper malware, posing a high risk of credential exposure and potential environment-wide compromise.

Recommendation

1. Deploy the provided Sigma rule to monitor for suspicious cross-process access requests.
2. Enable Sysmon EventCode 10 (ProcessAccess) logging across all critical Windows endpoints.
3. Review alerts generated by this rule immediately, as it is highly indicative of malicious activity when triggered by non-system processes.
4. Ensure that legitimate processes, such as LogonUI.exe and lsass.exe, are excluded from alerting logic to prevent false positives.