MITRE ATT&CK / Software / S0358

Ruler

ID
S0358
Type
Tool
Platforms
Windows, Office Suite
Source
attack.mitre.org
MITRE last modified
25 Apr 2025

Ruler is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of Ruler have also released a defensive tool, NotRuler, to detect its usage.[1][2]

Techniques used (4)

Groups using it (1)

References

  1. SensePost Ruler GitHub
  2. SensePost NotRuler