Loading malware…
Rubeus is an open-source C# Kerberos abuse toolkit for Windows Active Directory environments. It is widely used by red teams, penetration testers, and threat actors for raw Kerberos interaction, ticket extraction and manipulation, and credential-access operations centered on Kerberos authentication. Commonly documented uses include Kerberoasting, requesting or extracting ticket-granting tickets and service tickets, pass-the-ticket operations, overpass-the-hash style workflows, and forging or injecting Kerberos tickets such as Golden and Diamond Tickets. Rubeus also supports techniques such as abusing GSS-API-based delegation to obtain a usable TGT for the current user without requiring direct LSASS handle access in some workflows.
The tool is frequently associated with post-compromise activity rather than initial infection. It has been observed in intrusions involving commodity malware and ransomware ecosystems, including Qbot-delivered activity, Wizard Spider operations, Vice Society-related tradecraft, and destructive campaigns such as the 2025 Poland wiper attacks. It is also regularly referenced alongside other dual-use offensive tools such as Mimikatz, Cobalt Strike, BloodHound, AdFind, and Seatbelt.
Rubeus primarily targets Windows enterprise environments joined to Active Directory. Its operational value lies in enabling credential theft and lateral movement through Kerberos abuse, privilege escalation through forged or modified tickets, and post-exploitation actions that can facilitate broader domain compromise. Because some ticket submission and Kerberos package interactions can occur without the classic pattern of opening a suspicious handle to LSASS, Rubeus activity can create detection blind spots for defenses focused narrowly on LSASS access telemetry. Defenders commonly monitor for anomalous Kerberos ticket requests, NewCredentials logons, forged-ticket artifacts, suspicious .NET assembly loads, and execution patterns associated with Kerberos attack tooling.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
BadSuccessor is a critical attack vector that emerged following the release of Windows Server 2025. Under certain conditions, this server version enables users to leverage delegated Managed Service Accounts (dMSAs) to elevate privileges within Active Directory environments running Windows Server 2025. At the time of writing this article, no patch exists for this issue.
This detection leverages Windows Security Event Logs to identify TGT requests with unusual fields, which may indicate the use of tools like Rubeus following the exploitation of CVE-2021-36942 (PetitPotam).
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.
The threat actor also used the Rubeus C# toolset for raw Kerberos interaction and abuse...
“To secure long-term access to the environment, the SVR used the Rubeus toolkit to craft Ticket Granting Tickets (TGTs).”
“To secure long-term access to the environment, the SVR used the Rubeus toolkit to craft Ticket Granting Tickets (TGTs).”
23 distinct techniques documented for this family, organized by ATT&CK tactic.
You can specify if you want to use Kerberos or NTLM authentication. If you choose Kerberos, the tool will create a sacrificial token and use Rubeus to import/ask for the ticket. If NTLM is specified, the tool will use SharpKatz SetThreadToken or LogonUser impersonation.
Shadow Credentials - это атака на механизм хранения учётных данных в Active Directory, которая позволяет добавить в атрибут msDS-KeyCredentialLink объекта (пользователя или компьютера) пару ключей, а затем использовать их для получения билета Kerberos (TGT) от имени этого объекта.
net user Mishky Password123 /add ... net user Mishky Password123 /add /domain ; net group "Domain Admins" Mishky /add /domain
When the state is set to 2 (Completed), the Windows Domain Controller (the KDC) says: “Okay, the migration is completed. This new dMSA is now the official replacement. I will give this dMSA all the powers and group memberships that the old account used to have.”
After approximately 5 minutes, the malicious actors executed the Exec IcedID command to execute code by injecting the code into a cmd.exe instance.
You can specify if you want to use Kerberos or NTLM authentication. If you choose Kerberos, the tool will create a sacrificial token and use Rubeus to import/ask for the ticket. If NTLM is specified, the tool will use SharpKatz SetThreadToken or LogonUser impersonation.
Shadow Credentials - это атака на механизм хранения учётных данных в Active Directory, которая позволяет добавить в атрибут msDS-KeyCredentialLink объекта (пользователя или компьютера) пару ключей, а затем использовать их для получения билета Kerberos (TGT) от имени этого объекта.
Access Token Manipulation (ATT&CK technique: T1134) ... this section will explain how attackers can abuse access tokens and target the fundamental trust relationships in Windows domains to compromise entire networks.
After approximately 5 minutes, the malicious actors executed the Exec IcedID command to execute code by injecting the code into a cmd.exe instance.
The problem was that all the *.exes I had on Kali were things like Rubeus and Mimikatz, hence Windows Defender deleted them before AppLocker could even begin to do it’s job.
You can specify if you want to use Kerberos or NTLM authentication. If you choose Kerberos, the tool will create a sacrificial token and use Rubeus to import/ask for the ticket. If NTLM is specified, the tool will use SharpKatz SetThreadToken or LogonUser impersonation.
Access Token Manipulation (ATT&CK technique: T1134) ... this section will explain how attackers can abuse access tokens and target the fundamental trust relationships in Windows domains to compromise entire networks.
The createnetonly action will use the CreateProcessWithLogonW() API to create a new hidden (unless /show is specified) process with a SECURITY_LOGON_TYPE of 9 (NewCredentials), the equivalent of runas /netonly.
The KDC automatically copies the Security Identifiers (SIDs) of the Domain Admin and all their powerful groups (like “Schema Admins” or “Enterprise Admins”) into the dMSA’s ticket.
When the state is set to 2 (Completed), the Windows Domain Controller (the KDC) says: “Okay, the migration is completed. This new dMSA is now the official replacement. I will give this dMSA all the powers and group memberships that the old account used to have.”
Customers leveraging the Palo Alto Networks AutoFocus tool can track initially identified samples and tools under the Fireye_RedTeam_Tools, Rubeus, AndrewSpecial, KeeFarce, SafetyKatz, InveighZero, GadgetToJScript, SeatBelt, RuralBishop, SharpView, and SharpZeroLogon tags.
OS Credential Dumping: LSASS Memory T1003.001 Basic description The subtechnique known as OS Credential Dumping: LSASS Memory T1003.001 is used by attackers to obtain credentials in a Windows OS.
When the state is set to 2 (Completed), the Windows Domain Controller (the KDC) says: “Okay, the migration is completed. This new dMSA is now the official replacement. I will give this dMSA all the powers and group memberships that the old account used to have.”
мы можем добавить свой ключ и залогиниться... есть протокол (PKINIT), который позволяет логиниться без пароля. Есть хранилище ключей (msDS-KeyCredentialLink). Есть права, которые позволяют в это хранилище писать.
Both the Sapphire and Diamond Ticket attacks decrypt a legitimate TGT and change its PAC, and in order to do that, the adversary needs to have access to the KRBTGT account’s key (the password hash). | Diamond and Sapphire Tickets are forged TGTs created by modifying a legitimate TGT, which gives it additional privileges or a new identity.
One additional account, which was the only one with preauthentication disabled, was compromised via AS-REP roasting.
Shadow Credentials let us generate our own key pair and inject it into the msDS-KeyCredentialLink attribute of the target account. This gives us a way to authenticate as the user james without changing their actual password.
This method relies on the ability to obtain the user’s NTLM hash using the PKINIT mechanism. Rubeus asktgt /getcredential... Trying to retrieve NT hash... Got NT hash | Attacks on AD CS are becoming more popular by the day... You are more likely to get a certificate during exploitation... We may have stolen it from somewhere, such as a network share.
4. Overpass-the-hash (OPtH) The Overpass-the-hash technique applies the same concept as pass-the-hash with one key difference: it converts a hash into a fully fledged TGT ticket. | 2. Pass-The-Ticket Windows provides a native method to perform a very similar technique to the NETONLY flag using Kerberos ... arbitrarily change the cached Kerberos credentials (e.g., TGT) associated with their logon session.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used to forge and inject a Golden Ticket for Kerberos authentication, enabling privilege escalation to domain-level administrative access.
Rubeus is referenced as an executable offensive security/post-exploitation tool present on the tester's Kali VM and detected by Windows Defender during AppLocker testing.
Post-exploitation tool used to forge Kerberos Diamond Tickets for authentication abuse.
Rubeus is referenced as a tool that can request Kerberos TGTs in a suspicious or non-standard manner after PetitPotam exploitation, potentially enabling unauthorized access, privilege escalation, and persistence.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.