Metasploit 2026 Update: New Kerberos & Certificate Tracing — Detection and Hardening

---
title: Metasploit Console Execution
id: 66a9c3a1-2d44-4f9b-8f8c-9d1234567890
status: experimental
description: Detects the execution of the Metasploit console (msfconsole) or related Ruby processes often used to launch modules.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/16
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\ruby.exe'
      - '\rubyw.exe'
    CommandLine|contains:
      - 'msfconsole'
      - 'msfvenom'
  condition: selection
falsepositives:
  - Legitimate Ruby development or administration tools (rare on endpoints)
level: high
---
title: Suspicious Child Process of Ruby Interpreter
id: 77b1d4b2-3e55-5a0c-9g9d-0e2345678901
status: experimental
description: Detects suspicious command-line interpreters or system tools spawned as a child of Ruby, which may indicate Metasploit module execution.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/16
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ruby.exe'
      - '\rubyw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\bash.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare, legitimate Ruby scripts invoking system shells
level: medium

// Hunt for Metasploit Framework execution and potential Kerberos/Certificate activity
let MetasploitProcesses = 
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  | where FileName has "ruby" and (ProcessCommandLine has "msfconsole" or ProcessCommandLine has "msf");
// Cross-reference with network connections to domain controllers or KDC ports
MetasploitProcesses 
| join kind=inner (DeviceNetworkEvents 
  | where RemotePort in (88, 443, 445, 135) 
  | where InitiatingProcessFileName has "ruby") on DeviceId, InitiatingProcessId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemotePort, RemoteIP
| summarize count() by DeviceName, FileName, RemotePort

-- Hunt for Ruby processes indicative of Metasploit usage
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'ruby.exe'
   AND (CommandLine =~ 'msfconsole' OR CommandLine =~ 'msf')
-- Identify children of Ruby processes
SELECT Parent.Name AS ParentName, Child.Pid, Child.Name, Child.CommandLine
FROM pslist()
LEFT JOIN pslist() AS Child ON Child.Ppid = pslist.Pid
WHERE pslist.Name =~ 'ruby.exe'
  AND Child.Name IN ('powershell.exe', 'cmd.exe', 'whoami.exe', 'klist.exe')

# Audit AD CS Certificate Templates for ESC1 and ESC8 vulnerabilities
# Requires Active Directory module

Import-Module ActiveDirectory

Write-Host "[+] Auditing Certificate Templates for Misconfigurations..." -ForegroundColor Cyan

# Get all Certificate Templates
$templates = Get-ADObject -LDAPFilter "(objectClass=pKICertificateTemplate)" -Properties msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag, pKIExpirationPeriod, msPKI-RA-Signature

foreach ($template in $templates) {
    $name = $template.Name
    $flags = $template.'msPKI-Certificate-Name-Flag'
    $enrollmentFlags = $template.'msPKI-Enrollment-Flag'
    
    # ESC1 Check: ENROLLEE_SUPPLIES_SUBJECT
    if ($flags -band 0x00010000) {
        Write-Host "[ALERT] ESC1 Potential: '$name' allows any user to supply Subject (SAN)." -ForegroundColor Red
    }
    
    # ESC8 Check: ENROLLEE_SUPPLIES_SUBJECT (stronger check often linked to ESC8 scenarios)
    # Also checking for "Any Purpose" EKUs which is dangerous
    $ekus = $template | Select-Object -ExpandProperty pKIExtendedKeyUsage -ErrorAction SilentlyContinue
    if ($ekus -eq $null) {
        Write-Host "[WARNING] Template '$name' has no EKUs defined (Any Purpose)." -ForegroundColor Yellow
    }
}

# Check for ESC1 on specific templates vulnerable to current campaigns
$vulnerableTemplates = @("User", "Machine", "WebServer")
$adcsTemplates = Get-CATemplate | Where-Object { $vulnerableTemplates -contains $_.Name }

if ($adcsTemplates) {
    Write-Host "[ALERT] Found enabled templates matching common vulnerable names: $($adcsTemplates.Name -join ', ')" -ForegroundColor Red
} else {
    Write-Host "[+] No common vulnerable templates enabled." -ForegroundColor Green
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan