Kerberoasting via Rubeus, Impacket, or PowerView (T1558.003)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•1•0•4

This rule detects the execution of the Rubeus tool or the usage of common command-line arguments associated with Kerberoasting activities (e.g., GetUserSPNs, Request-SPNTicket). Kerberoasting is a technique used to extract service account password hashes from Active Directory by requesting service tickets for accounts with Service Principal Names (SPNs). These hashes can then be cracked offline to obtain cleartext credentials.