The article explains how Kaspersky Anti Targeted Attack (KATA) uses Network Anomaly Detection to identify Kerberoasting and DNS tunneling by spotting deviations from normal Kerberos and DNS behavior rather than relying on signatures. It also shows how prebuilt NAD rules, variables, and SQL-based logic help reduce false positives and surface actionable alerts for attacks that blend into legitimate network traffic. #KATA #Kerberoasting #DNStunneling #Kerberos #DNS
Keypoints
- Kerberoasting and DNS tunneling are presented as common stealth techniques used in modern intrusions.
- Traditional signature-based network tools struggle because the malicious traffic closely resembles legitimate Kerberos and DNS activity.
- KATA’s Network Anomaly Detection analyzes behavioral deviations across DNS, Kerberos, DCE/RPC, and other traffic types.
- Kerberoasting detection focuses on unusual TGS-REP patterns, such as many unique SPNs requested from one host or account in a short time.
- DNS tunneling detection looks for long random subdomains, static domain suffixes, TXT records, and unusually large data transfer volumes.
- NAD rules in KATA are SQL-based, use configurable variables, and can aggregate repeated alerts into a single event.
- The platform ships with 59 prebuilt NAD templates and supports up to 200 active rules at once.
MITRE Techniques
- [T1558.003 ] Steal or Forge Kerberos Tickets: Kerberoasting was described as requesting TGS tickets for service accounts with SPNs and cracking them offline to recover credentials (‘the attacker identifies service accounts configured with a Service Principal Name (SPN), requests a Ticket-Granting Service (TGS) ticket for them, and attempts to crack the password offline’).
- [T1132.001 ] Data Encoding: DNS Query: DNS tunneling used encoded or encrypted data in the left-hand portion of queried domain names to carry information (‘the lowest-level subdomain carries encoded or encrypted data sent from the client to the server’).
- [T1071.004 ] Application Layer Protocol: DNS: The article describes using DNS as a covert channel for C2 communication and exfiltration through normal-looking DNS requests and responses (‘This covert channel can be leveraged for C2 communication, bypassing network restrictions, or data exfiltration’).
- [T1048 ] Exfiltration Over Alternative Protocol: DNS tunneling was explicitly used to transmit data through DNS instead of normal channels (‘used to transmit data or control malware through firewalls by encoding information within DNS protocol requests and responses’).
- [T1020 ] Data Exfiltration: The text states that DNS tunneling can be leveraged for data exfiltration, moving data out through DNS traffic (‘can be leveraged for C2 communication, bypassing network restrictions, or data exfiltration’).
- [T1001.003 ] Data Obfuscation: Protocol Impersonation: The attacker’s traffic blends into normal Kerberos and DNS protocol behavior, making it hard to distinguish from legitimate traffic (‘this activity is virtually indistinguishable from legitimate network traffic’).
- [T1090.001 ] Proxy: Internal Proxy: DNS tunneling is described as bypassing network restrictions by routing communications through DNS infrastructure (‘used to transmit data or control malware through firewalls’).
Indicators of Compromise
- [Product / Platform Names] detection and alerting context – Kaspersky Anti Targeted Attack (KATA), Network Anomaly Detection (NAD)
- [Protocol / Log Fields] anomaly analysis context – DNS, DCE/RPC, Kerberos, cname, sname, rrname, rtype, rdata
- [Rule / Template Names] detection logic context – Signs of a Kerberoasting attack, DNS data tunneling via TXT records
- [Network Identifiers] rule variables and exclusions context – user_DNS_servers, excl_sip, excl_users
- [Domain Example] Kerberos service principal example – CIFS/fileserver.company.local, testlab.local
- [Message / Record Types] DNS tunneling context – KRB_TGS_REP, TGS-REQ, TGS-REP, TXT records
- [Threshold / Configuration Values] alerting context – 59 prebuilt NAD rule templates, 200 active rules
Read more: https://securelist.com/tr/network-anomaly-detection-in-kata/120892/