BIOC Medium

Impersonation using Rubeus tool

User authentication should not be impersonated, since this is considered a malicious behavior.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Evasion
Status:
Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Access Token Manipulation (T1134)
Indicator:

Process action type = execution AND target process cmd = * /ticket:* /impersonateuser:* , * /impersonateuser:* /ticket:*

Preventable: yes