BIOC
Medium
✕
Impersonation using Rubeus tool
User authentication should not be impersonated, since this is considered a malicious behavior.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Access Token Manipulation (T1134)
Indicator:
Process action type = execution AND target process cmd = * /ticket:* /impersonateuser:* , * /impersonateuser:* /ticket:*
Preventable: yes