Network Anomaly Detection in KATA
Kaspersky Anti Targeted Attack (KATA) uses Network Anomaly Detection to find Kerberoasting and DNS tunneling.
This article details how Kaspersky Anti Targeted Attack (KATA) utilizes Network Anomaly Detection (NAD) rules to identify sophisticated attack techniques like Kerberoasting and DNS tunneling. These methods are difficult for traditional tools to detect as they mimic legitimate network traffic. KATA's NAD analyzes network protocols such as DNS, DCE/RPC, and Kerberos to establish baselines and flag suspicious deviations, offering a more effective approach than signature-based detection.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky Anti Targeted Attack?
Get an email when a new story names Kaspersky Anti Targeted Attack, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTraditional signature-based detection tools consistently fail to identify sophisticated attack techniques such as Kerberoasting and DNS tunneling because these methods blend seamlessly into legitimate network traffic patterns. Attackers exploit trusted protocols — DNS, Kerberos, and DCE/RPC — precisely because they are rarely scrutinized at a behavioral level, making them ideal covert channels. Without baseline-aware, protocol-level monitoring, organizations remain blind to adversaries operating within their own trusted infrastructure. This matters because such techniques are commonly used in advanced persistent threat (APT) campaigns to exfiltrate data, escalate privileges, and move laterally undetected for extended periods.
What helps against this
How we list vendors- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.