Rubeus: Kerberos Abuse Toolkit Explained (and Detected)

Rubeus is an open-source C# toolset for raw interaction with Kerberos, the protocol Active Directory uses to authenticate users and services: it requests, roasts, steals, forges and injects tickets. Testers use it to prove how far one domain account can reach, and attackers, ransomware crews included, use it for the same reason. When it shows up in a report or an alert, it points at your service accounts, your delegation settings or where your administrators log on.

Which of these steps work in your domain is what our Active Directory security assessment tests, from one standard user: $6,000 for one domain of up to a few hundred hosts, with a free retest (multi-domain estates are quoted). That is the Small tier on the internal network penetration testing price page.

What Rubeus is

Rubeus was first released in 2018 by Will Schroeder (harmj0y) in the GhostPack collection of C# tools, adapting much of its Kerberos code from Kekeo, by Mimikatz author Benjamin Delpy. It is licensed BSD 3-Clause and runs on Windows.

For defenders, two facts matter. The project deliberately publishes no compiled binaries, so every copy is a third-party build and hash blocklists catch only known ones. And as a .NET assembly, it is usually loaded into memory by a command-and-control framework rather than written to disk. Detect what it does, not a file name.

MITRE ATT&CK tracks it as software S1071, used since at least 2020, including in ransomware operations, and lists Wizard Spider and MirrorFace among its users. In the 2025 wiper attacks on Polish energy sites, the operators used it to build a diamond ticket.

What Rubeus does: six families of functions

Grouped by what they do to your domain, its functions fall into six families:

Family	Functions	What it does
Roasting	kerberoast, asreproast, preauthscan	Finds accounts without pre-authentication (preauthscan) and gets tickets encrypted with a password-derived key, for offline guessing
Ticket requests	asktgt, asktgs, renew, brute	Gets tickets from a password, NT hash, AES key or certificate; sprays passwords
Delegation abuse	s4u	Gets tickets as another user through delegation
Ticket theft	triage, dump, tgtdeleg, monitor, harvest	Exports tickets from memory or collects them from new logons
Ticket use	ptt, createnetonly	Loads a ticket into a logon session, the step behind pass-the-ticket and lateral movement
Forgery	golden, silver, diamond	Builds or rewrites tickets with a stolen krbtgt or service key

Rubeus kerberoast

Kerberoast is the function most people search for. It requests a service ticket for each user account with a service principal name (SPN), in practice your service accounts, and any authenticated user may do this. Each ticket is encrypted with the service account’s key, so the password can be attacked offline. Our Kerberoasting guide covers the technique, including what retiring RC4 changed.

Rubeus asktgt

The asktgt function requests a ticket-granting ticket with whatever secret the operator holds. With an NT hash, often taken with Mimikatz, that is overpass-the-hash: a hash lifted from one machine becomes Kerberos access everywhere the account can go. With a certificate, it is usually the payoff of an Active Directory Certificate Services (AD CS) weakness or of write access to an account’s msDS-KeyCredentialLink attribute (shadow credentials).

Rubeus asreproast

The asreproast function asks the domain controller for a ticket-granting ticket for any account that does not require Kerberos pre-authentication. Part of the reply is encrypted with a key derived from that account’s password, so it can be guessed offline, which MITRE tracks as AS-REP Roasting (T1558.004). In a report it means one specific account setting is wrong: turn pre-authentication back on, and watch for 4768 events with Pre-Authentication Type 0.

Rubeus s4u

The s4u function uses the two Kerberos delegation extensions, S4U2self and S4U2proxy, to get a service ticket in another user’s name. It needs the key of an account that is trusted for constrained delegation, or one named in a resource-based delegation entry, so a working s4u step shows that a delegation setting, not a password, gave the tester an administrator’s access to a service. The domain controller records it as a 4769 with Transited Services filled in.

Rubeus tgtdeleg

The tgtdeleg function returns a usable ticket-granting ticket for the current user, with its session key and without elevation, by using the Kerberos GSS-API to fake a delegation request, as the project’s README describes. For a defender the lesson is that a compromised standard user session yields a ticket that works from another machine until it expires, with no administrator rights and no access to LSASS. Accounts in Protected Users cannot be delegated, which is one more reason to put human administrators there.

Forged tickets

Forgery needs keys only a prior compromise provides, so it shows persistence. A diamond ticket, a real ticket with rewritten privileges, is harder to spot than a golden one because a genuine request sits behind it. Our golden and silver ticket guide covers detection and recovery.

What its use reveals about your environment

Most Rubeus successes point back to a setting someone chose or a habit someone kept:

• A cracked kerberoast ticket: a service account with a human-chosen password, often old and often privileged.
• An AS-REP roast: an account set to “Do not require Kerberos preauthentication”, usually for a legacy application.
• A working delegation chain: unconstrained delegation outside domain controllers, or delegation entries nobody owns.
• Harvested tickets: administrators logging on to workstations and member servers, a tiering failure.
• A certificate-based ticket: a template or enrollment right that let a user obtain a certificate for someone else, or write access to another account’s key credentials.
• A forged ticket: for a golden or diamond ticket, the krbtgt key is in someone else’s hands; reset krbtgt twice and treat the domain as compromised. For a silver ticket, that service account’s key is; reset it and find how it was taken.

BloodHound shows where these sit on the path to Domain Admin; Rubeus proves each Kerberos step works, and Impacket covers the same ground from Linux, often after Kerbrute finds the usernames. Each fix maps to a check in our Active Directory hardening checklist.

Rubeus detection: what to log and what to alert on

The domain controller sees every ticket request; the endpoint sees which process sent it. Enable “Audit Kerberos Authentication Service” and “Audit Kerberos Service Ticket Operations” for success and failure on every domain controller, and forward the Security log, plus the System log’s KDCSVC events, off the box.

Rubeus activity	Log source	Event or signal	What it means
Kerberoasting	DC Security log	4769 with Ticket Encryption Type 0x17 (RC4), or one account requesting many SPNs in minutes	Tickets requested for offline cracking
AS-REP roasting, spraying	DC Security log	4768 with Pre-Authentication Type 0; 4771 with failure code 0x18 across many accounts from one source	No pre-authentication; passwords guessed over Kerberos
Overpass-the-hash	DC Security log	4768 with RC4 pre-authentication from a client that normally uses AES	A hash obtained the ticket; a stolen AES key looks normal, so pair with endpoint rows
Certificate-based ticket	DC Security log	4768 with certificate fields filled for an account that never uses smart cards	Possible AD CS or shadow credential abuse
Delegation abuse	DC Security log	4769 with Transited Services populated for an unexpected account	Delegation used to impersonate a user
Pass-the-ticket	Identity sensor, DC logs	One ticket used on two or more computers; 4769 with no prior 4768 from that host	A stolen ticket reused
Raw ticket requests (asktgt, s4u, spraying, AS-REP roasting)	EDR, Sysmon Event ID 3 (off by default)	Port 88 traffic from a process other than lsass.exe	Something other than Windows is speaking Kerberos
Ticket extraction as admin (triage, dump, monitor, harvest)	EDR; Sysmon Event ID 10 with a rule covering winlogon.exe	An unusual process opening winlogon.exe and copying its SYSTEM token before reading other sessions’ tickets; builds from before January 2024 also logged 4611 (Audit Security System Extension) for logon process User32LogonProcesss	Tickets read from other sessions; a process already running as SYSTEM skips the winlogon step
Sacrificial session (createnetonly)	Endpoint Security log	4624 Logon Type 9, logon process seclogo; runas /netonly looks the same	A session prepared for an injected ticket; hunt, do not alert
In-memory loading	AMSI (on .NET Framework 4.8 and Windows 10 or later), EDR, PowerShell 4104	A .NET assembly loaded from memory into an unusual process, or a script block naming Invoke-Rubeus	Execution through a C2 framework or PowerShell wrapper; recompiled copies can slip past

Default Rubeus kerberoasting asks Windows for the tickets, as MITRE’s Kerberoasting entry notes, so its traffic comes from lsass.exe; catch it with 4769 on the domain controller, not on the host.

Two changes make these detections stronger in late 2026:

• AES is now the default for service tickets. Since Microsoft’s April 14, 2026 update, RC4 tickets go only to accounts, or domains, still set to allow RC4, so any 0x17 ticket for a user service account deserves a look, and KDCSVC 203 or 208 means a client asked for RC4 only and was refused. Our Kerberoasting guide covers the rollout and the events.
• Named alerts. Microsoft Defender for Identity has alerts for SPN exposure, AS-REP roasting, over-pass-the-hash, pass-the-ticket, BronzeBit delegation and golden ticket use.

Hunting for RC4 service ticket requests

The 4769 hunt in the first row of the table needs four conditions, whatever SIEM you use. The field names are in Microsoft’s event 4769 reference.

1. Event ID 4769 on the domain controllers.
2. Ticket encryption type 0x17, which is RC4.
3. A service name that does not end in $ and is not krbtgt, so machine accounts and ticket-granting requests drop out.
4. Results grouped by requesting account and source address in a short window, such as ten minutes, so one account asking for many service tickets stands out.

Test the rule against your own data before you alert on it: field extraction differs between log connectors, and the right threshold depends on how many accounts still allow RC4.

A honeytoken service account (an SPN, a long random password, no real use) catches what thresholds miss: any 4769 naming it is close to certain kerberoasting. Per the project’s documentation, harvest avoids opening a read handle to LSASS, so LSASS-access alerts miss it; the winlogon.exe token access above, or 4611 from an older build, is where it shows.

How to make Rubeus fail

Control	What it stops	How to check
Group managed service accounts; elsewhere, random passwords of 25 or more characters, per MITRE’s Kerberoasting guidance	Crackable kerberoast tickets	List SPN accounts with password-last-set dates
AES only on service accounts, with explicit RC4 settings removed	RC4 downgrade and cheap cracking	Hunt 4769 with 0x17 and KDCSVC 201 to 209
Pre-authentication required everywhere	AS-REP roasting	Find accounts with “Do not require Kerberos preauthentication”
No unconstrained delegation outside domain controllers; constrained and resource-based delegation reviewed; machine account quota 0	Delegation abuse, including tickets captured in monitor mode after coercion attacks such as PetitPotam	Review delegation attributes
Protected Users for human admins, after testing	NTLM, RC4 and DES pre-authentication, and delegation, for members; caps their TGTs at four hours	Review membership
Tiered administration, plus Credential Guard on workstations and member servers	Privileged tickets on lower-tier hosts, and reuse of TGTs dumped from protected machines; service tickets stay exposed	Find Tier 0 logons on non-Tier 0 hosts
krbtgt reset twice after any suspected compromise, and on a schedule	Golden and diamond tickets	Check krbtgt password-last-set

Never add service or computer accounts to Protected Users. Credential Guard isolates TGT session keys, so TGTs dumped from a protected machine cannot be reused elsewhere. As Microsoft notes in its protection limits, service tickets stay exposed, and malware running as the user can still use that user’s credentials on the machine, for example to request service tickets for kerberoasting. Credential Guard is on by default for qualifying domain-joined machines on Windows 11 22H2 or later (Enterprise or Education) and Windows Server 2025, though not on domain controllers.

How Invadel tests for it, and what it costs

Kerberos abuse is a core part of our Active Directory security assessment. From one standard domain user, a senior tester finds every roastable account and tests whether its password holds, maps delegation and certificate paths, and checks whether privileged tickets can be taken from the machines we reach. Nothing on a domain controller is changed, any spraying stays under the lockout threshold you set, and testing runs in agreed windows.

Each Kerberos step that works becomes its own finding: the ticket obtained, the account or setting that allowed it, and the domain controller event (4768 or 4769) or endpoint signal from the detection table that should have recorded it, mapped to MITRE ATT&CK. Graded detection is the red team or purple team below.

Question about Rubeus-style attacks	Engagement	From
Which roasting, delegation, certificate and ticket-theft steps work from one standard user?	Active Directory security assessment	$6,000 for one domain
Do the tickets and passwords those steps yield also open the hosts and segments around the domain?	Internal network penetration test	$6,000 Small, $9,200 Medium, $14,500+ Large
Would your SOC spot a Kerberos toolkit loaded in memory through a C2 framework?	Red team	$12,500 (see red team pricing)
Do the domain controller and endpoint rows in the detection table fire?	Purple team	Quoted

The free retest repeats each step that worked once your fixes are in. A sample report shows how findings like these are written up; every penetration test is priced in writing before work starts and includes an attestation letter, and all prices are on our pricing page.

Frequently asked questions

Is Rubeus malware? No. It is an open-source tool built for penetration testers and red teams, but MITRE records its use by ransomware operators, so treat unexplained Rubeus activity as an incident.

What is the difference between Rubeus and Mimikatz? Mimikatz is best known for reading credentials out of Windows memory; Rubeus focuses on the Kerberos protocol itself. Attackers often pair them, with Mimikatz supplying a hash that Rubeus turns into a ticket.

What is a diamond ticket, and how is it different from a golden ticket? A golden ticket is built from nothing with a stolen krbtgt key. A diamond ticket starts as a real ticket the domain controller issued, then has its privileges rewritten with that same key, so a genuine 4768 request sits behind it. Both mean the krbtgt key is compromised and both need the double krbtgt reset.

Can Rubeus run from Linux? Not natively: it is a C# tool for Windows and normally runs on a domain-joined or compromised Windows host. Testers working from Linux use Impacket for the same Kerberos steps, which is why the domain controller events matter more than any one tool’s name.

Will antivirus or EDR stop Rubeus? They usually catch unmodified builds of the public source and the precompiled copies that circulate, but an operator can recompile and obfuscate it to dodge signatures. The domain controller cannot be fooled about which tickets it issued, so 4768 and 4769 matter more than any file signature.

Does Rubeus need administrator rights? Not for most of what matters: any domain user can run kerberoast, asreproast, asktgt and tgtdeleg, and s4u needs only the delegated account’s key. Dumping, monitoring or harvesting other users’ tickets needs local admin on that machine, which is why tiering limits the damage.

How much does it cost to test our domain against Rubeus-style attacks? Every Active Directory security assessment tries these ticket attacks, at $6,000 for one domain of up to a few hundred hosts. The report lists which ones worked, the setting behind each and its fix, and the free retest confirms they no longer work.

The short version

Rubeus requests, roasts, steals, forges and injects Kerberos tickets, and each success points at a fixable choice: weak service-account passwords, RC4, disabled pre-authentication, loose delegation or admins logging on where they should not. Detect it with 4768 and 4769 on domain controllers and with EDR telemetry on endpoints; make it fail with managed passwords, AES, Protected Users and tiering. Find out which steps work in your domain with an Active Directory security assessment, compare the internal network testing prices, or scope your test.