On-Demand Webinar

Rubeus Createnetonly (Kerberos)

On-Demand Webinar

Rubeus Createnetonly (Kerberos)

Detection Strategies

Overview of Rubeus createnetonly

The createnetonly action will use the CreateProcessWithLogonW() API to create a new hidden (unless /show is specified) process with a SECURITY_LOGON_TYPE of 9 (NewCredentials), the equivalent of runas /netonly. The process ID and LUID (logon session ID) are returned. This process can then be used to apply specific Kerberos tickets to with the ptt /luid:0xA.. parameter, assuming elevation. This prevents the erasure of existing TGTs for the current logon session.

References

Request Access to Use Case Repository

Tags

Defense Evasion

Privilege Escalation

Credential Access

Splunk

Kerberoasting

Steal or Forge Kerberos Tickets

Get the Latest Resources

Leave Your Data Where You Want: Detect Across Snowflake

Demo Series
Leave Your Data Where You Want: Detect Across Snowflake
Watch

MonteAI: Your Detection Engineering & Threat Hunting Co-Pilot

Demo Series
MonteAI: Your Detection Engineering & Threat Hunting Co-Pilot
Watch
White Paper

Rubeus Createnetonly (Kerberos)

Tools
May 4, 2021

Rubeus Createnetonly (Kerberos)

Overview of Rubeus createnetonly

The createnetonly action will use the CreateProcessWithLogonW() API to create a new hidden (unless /show is specified) process with a SECURITY_LOGON_TYPE of 9 (NewCredentials), the equivalent of runas /netonly. The process ID and LUID (logon session ID) are returned. This process can then be used to apply specific Kerberos tickets to with the ptt /luid:0xA.. parameter, assuming elevation. This prevents the erasure of existing TGTs for the current logon session.

References

Request Access to Use Case Repository

Tags

Defense Evasion

Privilege Escalation

Credential Access

Splunk

Kerberoasting

Steal or Forge Kerberos Tickets

Break Free from SIEM Lock-in

Break Free from SIEM Lock-in