The article details Kaspersky's Network Anomaly Detection (NAD) technology within the KATA platform, focusing on two detection scenarios: Kerberoasting and DNS tunneling via TXT records. NAD uses SQL-based behavioral analytics against network session data in ClickHouse to identify deviations from baseline host behavior, overcoming limitations of traditional signature-based IDS tools that cannot distinguish malicious Kerberos TGS requests or DNS tunneling from legitimate traffic. The approach correlates multiple indirect indicators — anomalous SPN request volume, unusual DNS query patterns, data transfer thresholds — into consolidated alerts with tunable infrastructure-specific variables.
kerberoasting
1 post
Network Anomaly Detection in KATA