Mimikatz Rubeus lateral movement: TTPs

Mimikatz Rubeus lateral movement refers to a family of adversarial techniques where attackers use Mimikatz and Rubeus to traverse an Active Directory environment after initial compromise. Mimikatz is a post-exploitation tool that extracts plaintext passwords, NTLM hashes, and Kerberos tickets directly from Windows memory — specifically from the LSASS process. Rubeus is a C# Kerberos abuse toolkit that manipulates tickets at a lower level, without touching LSASS directly, making it stealthier. Together, they enable three primary lateral movement primitives: Pass-the-Hash (PTH), which reuses an NTLM hash to authenticate without knowing the plaintext password; Pass-the-Ticket (PTT), which injects a stolen or forged Kerberos TGT or service ticket into the current session; and Overpass-the-Hash (also called Pass-the-Key), which converts an NTLM hash into a Kerberos TGT request. Rubeus also supports Kerberoasting, AS-REP Roasting, and ticket renewal abuse. These techniques are relevant because they allow privilege escalation and host-to-host pivoting using only legitimate Windows authentication protocols, making them hard to distinguish from normal traffic without targeted telemetry.

Detecting Mimikatz and Rubeus lateral movement requires layered telemetry across endpoint and network sources. On endpoints, enable Sysmon Event ID 10 to catch LSASS process access attempts — Mimikatz triggers ReadProcessMemory calls against lsass.exe, visible as suspicious GrantedAccess values (0x1010, 0x1410). Windows Security Event ID 4624 with Logon Type 3 or 9 combined with no corresponding 4768/4769 Kerberos events can indicate Pass-the-Hash. For Pass-the-Ticket, look for Event ID 4768 or 4769 requests with unusual encryption types (RC4 where AES is standard) or requests originating from hosts that do not normally request tickets for that service. Rubeus AS-REP Roasting generates Event ID 4768 responses with pre-authentication disabled. Kerberoasting triggers Event ID 4769 with RC4 encryption and a NULL or suspicious client IP. On the network, Zeek or Suricata can flag anomalous Kerberos traffic patterns. EDR solutions like Elastic Endpoint or Microsoft Defender for Endpoint have signatures for sekurlsa::logonpasswords and common Rubeus command patterns. Canary NTLM hashes planted in LSASS via HoneyTokens reliably expose credential dumping attempts in near real-time.

Red Team operators use Mimikatz and Rubeus at multiple stages of a campaign. After gaining local admin rights on a workstation, sekurlsa::logonpasswords extracts cached credentials from LSASS memory. Those NTLM hashes feed directly into Pass-the-Hash using sekurlsa::pth or Impacket psexec.py on Linux. Rubeus harvest /interval:30 monitors new Kerberos tickets as users authenticate, enabling opportunistic ticket theft. For Kerberoasting, Rubeus kerberoast /outfile:hashes.txt requests service tickets for SPNs, which are then cracked offline with Hashcat mode 13100. Overpass-the-Hash with Rubeus asktgt /rc4: generates a TGT usable for further pivoting without NTLM authentication. Against hardened environments, operators combine these with OPSEC flags: /opsec in Rubeus requests AES tickets to blend in. Counter-measures include enabling Credential Guard to block LSASS memory access, enforcing Protected Users security group membership for privileged accounts, disabling RC4 Kerberos encryption across the domain, and auditing SPNs to minimize Kerberoastable accounts. Tiered administration models and Just-In-Time access further reduce the blast radius of any successful credential capture.