AS-REP Roasting via Rubeus or PowerShell - T1558.004

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

This rule detects potential AS-REP Roasting activities by monitoring process creations for the Rubeus toolset (using the asreproast command) and PowerShell scripts executing commands related to AS-REP Roasting (Get-ASREPHash or asreproast). This technique is used by adversaries to extract Kerberos TGTs for accounts with Kerberos pre-authentication disabled, allowing for offline password cracking.