Conti – Rubeus Kerberos Abuse Followed by PsExec Lateral Movement

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

MITRE ATT&CK

T1021.002

SMB/Windows Admin Shares

Data Source

DeviceProcessEvents

Date Added

2026-07-23

Last Updated

2026-07-23

Source

ransomware.live group_tools dataset (conti)

What This Detects

Conti's playbook chains Rubeus (ticket requests/Kerberoasting) with PsExec-based lateral movement over SMB admin shares within a few hours, after AdFind/BloodHound recon.

Query

let rubeus = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("Rubeus","kerberoast","asktgt","s4u")
| project DeviceName, RubeusTime = Timestamp, AccountName;
let psexec = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("psexesvc.exe","psexec.exe")
| project DeviceName, PsExecTime = Timestamp;
rubeus
| join kind=inner psexec on DeviceName
| where PsExecTime - RubeusTime between (0min .. 4h)
| project DeviceName, AccountName, RubeusTime, PsExecTime

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.