Register new Logon Process by Rubeus

Title: Register new Logon Process by Rubeus
Status: test
Description:Detects potential use of Rubeus via registered new trusted logon process
References:
  -https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
Author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community
Date: 2019-10-24
modified:2022-10-09
Tags:

• -'attack.lateral-movement'
• -'attack.privilege-escalation'
• -'attack.credential-access'
• -'attack.t1558.003'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4611'
    LogonProcessName: 'User32LogonProcesss'
  condition:selection
Falsepositives:
  -Unknown
Level: high