Detection: Rubeus Kerberos Ticket Exports Through Winlogon Access

Updated Date: 2026-09-08 ID: 5ed8c50a-8869-11ec-876f-acde48001122 Author: Mauricio Velazco, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects an uncommon process requesting full access rights to winlogon.exe, which may indicate Rubeus exporting Kerberos tickets from memory. It leverages Sysmon EventCode 10 and checks for full-access rights, specifically the value 0x1f3fff.

Search

 1`sysmon`
 2EventCode=10
 3TargetImage="*:\\Windows\\system32\\winlogon.exe"
 4NOT SourceImage IN (
 5    "C:\\Windows\\system32\\LogonUI.exe",
 6    "C:\\Windows\\system32\\lsass.exe",
 7    "C:\\Windows\\system32\\smss.exe",
 8    "C:\\Windows\\system32\\svchost.exe",
 9    "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
10)

Convert GrantedAccess from hexadecimal to decimal. 0x1f3fff is the legacy full-access mask observed for this activity.

 1
 2| eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
 3
 4| eval PROCESS_ALL_ACCESS_LEGACY = 2047999
 5
 6| eval legacy_full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS_LEGACY)
 7
 8| where legacy_full_access_set == PROCESS_ALL_ACCESS_LEGACY
 9
10
11
12| stats count min(_time) as firstTime
13                max(_time) as lastTime
14    BY user_id dest
15       signature_id signature granted_access Opcode
16       SourceImage SourceProcessGUID SourceProcessId
17       TargetImage TargetProcessGUID TargetProcessId
18       CallTrace vendor_product
19
20
21| eval CallTrace=split(CallTrace, "
22|")
23
24
25| `security_content_ctime(firstTime)`
26
27| `security_content_ctime(lastTime)`
28
29| `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 10	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
sysmon	`(source=WinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational)`
rubeus_kerberos_ticket_exports_through_winlogon_access_filter	`search *`

rubeus_kerberos_ticket_exports_through_winlogon_access_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1550.003	Pass the Ticket	Lateral Movement

Exploitation

DE.CM

CIS 10

APT32

BRONZE BUTLER

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment.

Known False Positives

No false positives have been identified at this time.

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
The process [$SourceImage$] requested full access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$].	dest	system	50

Threat Objects

Field	Type
SourceImage	file_path

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 15