Network Anomaly Detection in KATA

This article demonstrates how Network Anomaly Detection (NAD) in Kaspersky’s KATA platform can effectively detect Kerberoasting and DNS tunneling attacks, which are increasingly common methods for attackers to bypass traditional security tools. NAD analyzes network traffic for suspicious patterns and deviations from a host’s normal behavior, offering a more robust approach than signature-based detection. The article details how NAD identifies Kerberoasting by correlating TGS-REP responses for unique SPNs from a single IP address and how it detects DNS tunneling by analyzing TXT records for encoded data. NAD’s use of variables allows for flexible rule customization to fit different network environments, minimizing false positives.