Skip to content
Threat Feed
Subscribe

Tag

Rubeus

2 briefs RSS
high advisory

Detection of Rubeus Kerberos Ticket Extraction via Winlogon Access

This brief describes the detection of unauthorized processes requesting full access to winlogon.exe, a technique used by the Rubeus tool to extract Kerberos tickets from memory.

Windows credential-access defense-evasion rubeus
1r 1t
high advisory

Detects Kirbi File Creation

Detects the creation of .kirbi files, a suspicious Kerberos ticket artifact often produced by ticket export or dumping tools such as Rubeus or Mimikatz, indicating preparation for Kerberos ticket theft or Pass-The-Ticket (PTT) attacks.

Microsoft Defender XDR +2 credential-access kerberos pass-the-ticket mimikatz rubeus
2r 1t