Traditional network security tools often struggle to detect modern attack techniques like Kerberoasting and DNS tunneling because these methods leverage standard infrastructure protocols, making them virtually indistinguishable from legitimate traffic. This article explores how Network Anomaly Detection (NAD), implemented within the Kaspersky Anti Targeted Attack (KATA) platform, addresses this challenge by shifting the focus from static signatures to behavioral analysis. By monitoring for deviations from baseline host activity, NAD allows security teams to identify suspicious artifacts in protocols like Kerberos, DNS, and DCE/RPC.
The article provides technical deep dives into detecting Kerberoasting—where attackers request multiple service tickets for offline cracking—and DNS tunneling, which uses TXT records for covert data exfiltration. Unlike traditional Intrusion Detection Systems (IDS) that can be overwhelmed by false positives, KATA’s NAD uses SQL-based rules to correlate indicators such as request frequency, unique SPN counts, and data transfer volumes. This approach provides analysts with actionable hypotheses for early-stage compromise detection, especially against stealthy APT campaigns.
Top comments (0)