Potential Credential Access via Rubeus

[rule]
description = """
Identifies the usage of Rubeus using known malicious command line arguments. Rubeus is a toolset used for a diverse set
of Kerberos Abuses and Manipulations like renew, ask, extract, and forge Kerberos Tickets.
"""
id = "0783f666-75ad-4015-9dd5-d39baec8f6b0"
license = "Elastic License v2"
name = "Potential Credential Access via Rubeus"
os_list = ["windows"]
reference = [
    "https://github.com/GhostPack/Rubeus",
    "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_rubeus.yml",
]
version = "1.0.28"

query = '''
process where event.action == "start" and
  process.command_line : (
    "* asreproast *",
    "* dump /service:krbtgt*",
    "* dump /luid:*",
    "* kerberoast *",
    "* createnetonly /program:*",
    "* ptt /ticket:*",
    "* /impersonateuser:*",
    "* renew /ticket:*",
    "* asktgt /user:*",
    "* asktgs /ticket:*",
    "* harvest /interval:*",
    "* s4u /user:*",
    "* s4u /ticket:*",
    "* hash /password:*",
    "* tgtdeleg",
    "* tgtdeleg /target:*",
    "* golden /des:*",
    "* golden /rc4:*",
    "* golden /aes128:*",
    "* golden /aes256:*",
    "* changpw /ticket:*"
  )
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"