Hacktool Ruler Usage Detection
This rule detects the use of the hacktool Ruler by Sensepost, specifically looking for 'RULER' in the Workstation or WorkstationName fields of Windows Security Event IDs 4776 (Credential Validation) and 4624/4625 (Logon/Logoff). Ruler is a tool designed to abuse Microsoft Exchange services.
Sigma
