1200KM / tool
Rubeus — Attack Tool
Rubeus is a C# toolset designed for raw Kerberos interaction that has been used since at least 2020, including in ransomware operations.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: Rubeus
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Wizard Spider · G0102 · Pinned relationship source (relationship--afa1618c-6a9b-49a4-8105-5cae16b3415f)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
- T1482 · Domain Trust Discovery · Detection rules & anomalies
- T1550.003 · Pass the Ticket · Detection rules & anomalies
- T1558.001 · Golden Ticket · Detection rules & anomalies
- T1558.002 · Silver Ticket · Detection rules & anomalies
- T1558.003 · Kerberoasting · Detection rules & anomalies
- T1558.004 · AS-REP Roasting · Detection rules & anomalies
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.