[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_sHUNXkHEpVtFn1aNpBOzJQjRQEKcElp52La8CUctCg":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":109},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"d5aab834-f405-4169-be50-f94be8b57ea2","Network Anomaly Detection in KATA","network-anomaly-detection-in-kata-e82513","An analysis of how Network Anomaly Detection (NAD) rules work within Kaspersky Anti Targeted Attack, using Kerberoasting and DNS tunneling attacks as examples.","This article details how Kaspersky Anti Targeted Attack (KATA) utilizes Network Anomaly Detection (NAD) rules to identify sophisticated attack techniques like Kerberoasting and DNS tunneling. These methods are difficult for traditional tools to detect as they mimic legitimate network traffic. KATA's NAD analyzes network protocols such as DNS, DCE\u002FRPC, and Kerberos to establish baselines and flag suspicious deviations, offering a more effective approach than signature-based detection.","Kaspersky Anti Targeted Attack (KATA) uses Network Anomaly Detection to find Kerberoasting and DNS tunneling.","https:\u002F\u002Fsecurelist.com\u002Ftr\u002Fnetwork-anomaly-detection-in-kata\u002F120892\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F07\u002F31090131\u002Fkata-nad-featured-image-scaled-1.jpg","2026-07-31T10:00:25+00:00","2026-07-31T12:00:28.627582+00:00",7,[17,20,23,25,27],{"name":18,"type":19},"Kaspersky Anti Targeted Attack","product",{"name":21,"type":22},"Network Anomaly Detection","technology",{"name":24,"type":22},"Kerberoasting",{"name":26,"type":22},"DNS tunneling",{"name":28,"type":22},"Kerberos protocol","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":31,"name":32,"slug":33},null,"Threat Intelligence","threat-intelligence",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":29,"icon":31,"name":32,"slug":33},[],[18],{"controls":50,"vendors":108},[51,80],{"slug":52,"name":53,"problem":54,"products":55},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":33,"name":81,"problem":82,"products":83},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":110,"title":111,"body":112,"framework_refs":113,"framework_notes":124},"behavioral-network-analysis-key-to-catching-stealthy-attacks-like-kerberoasting-and-dns-tunneling","Behavioral Network Analysis Key to Catching Stealthy Attacks Like Kerberoasting and DNS Tunneling","Traditional signature-based detection tools consistently fail to identify sophisticated attack techniques such as Kerberoasting and DNS tunneling because these methods blend seamlessly into legitimate network traffic patterns. Attackers exploit trusted protocols — DNS, Kerberos, and DCE\u002FRPC — precisely because they are rarely scrutinized at a behavioral level, making them ideal covert channels. Without baseline-aware, protocol-level monitoring, organizations remain blind to adversaries operating within their own trusted infrastructure. This matters because such techniques are commonly used in advanced persistent threat (APT) campaigns to exfiltrate data, escalate privileges, and move laterally undetected for extended periods.",[114,115,116,117,118,119,120,121,122,123],"MITRE ATT&CK T1558.003 (Kerberoasting)","MITRE ATT&CK T1071.004 (DNS Application Layer Protocol)","CIS Control 13 – Network Monitoring and Defense","CIS Control 6 – Access Control Management","NIST SP 800-137 – Continuous Monitoring","NIST DE.CM-1 – Network Monitoring (NIST CSF)","NIST AC-6 – Least Privilege","NIST SI-4 – Information System Monitoring","ISO\u002FIEC 27001 Annex A.12.4 – Logging and Monitoring","ITIL – Event Management (Service Operation)",{}]