Kaspersky KATA Leverages Network Anomaly Detection to Uncover Stealthy Attacks
Kaspersky's KATA platform employs Network Anomaly Detection (NAD) to identify sophisticated threats like Kerberoasting and DNS tunneling that bypass traditional security measures.
In the aftermath of a network breach, attackers often pivot to leveraging standard domain infrastructure protocols, including Kerberos and DNS, to move laterally and exfiltrate data. This activity, however, is notoriously difficult to detect with conventional security tools because it closely mimics legitimate network traffic. Techniques such as Kerberoasting and DNS tunneling have become prevalent in modern attacks precisely because they allow adversaries to achieve critical compromise stages while evading signature-based detection.
Traditional network security solutions excel at identifying threats with distinct signatures, such as known malicious query strings or exploit code. However, these methods fall short when attacks blend seamlessly with normal network operations. Network Anomaly Detection (NAD), as implemented in Kaspersky's Anti Targeted Attack (KATA) platform, offers a different approach. Instead of relying on predefined indicators, NAD analyzes network traffic for deviations from a host's typical behavior, identifying suspicious artifacts that signal malicious intent.
The KATA platform scrutinizes network traffic, including DNS, DCE/RPC, and Kerberos packets, to pinpoint anomalous activity. This allows for the detection of a wide range of threats, from attacks on domain controllers and C2 communications to data tunneling and exfiltration, all of which can indicate a compromise of network infrastructure. The effectiveness of NAD lies in its tailored detection models, which are customized for specific network protocols and baseline host behaviors.
One significant challenge for security tools is detecting Kerberoasting attacks. This technique exploits the Kerberos protocol's normal operations. Attackers target service accounts with Service Principal Names (SPNs), request Ticket-Granting Service (TGS) tickets for them, and then attempt to crack the ticket's password offline. If the password is weak, the attacker can obtain cleartext credentials for lateral movement. The critical issue is that the TGS ticket requests made by attackers are indistinguishable from legitimate ones, and the sheer volume of Kerberos traffic makes manual analysis infeasible.
NAD addresses this by correlating indirect indicators. KATA's NAD rules look for anomalies such as an unusual source for ticket requests, a surge in SPN requests from a single host or user within a short period, requests for tickets associated with sensitive service accounts, or activity occurring outside normal business hours. By analyzing these deviations from the established baseline, KATA can hypothesize which host initiated the attack, which service accounts are targeted, and why the activity is anomalous.
Similarly, DNS tunneling, another stealthy technique, involves using the DNS protocol to exfiltrate data or establish command and control channels. Attackers embed malicious data within DNS queries and responses, making it appear as legitimate DNS traffic. Traditional tools often miss this because the protocol itself is not inherently malicious. NAD, however, can detect anomalies such as unusually long DNS queries or responses, a high volume of DNS traffic from a specific host, or the use of non-standard DNS record types, all of which can indicate tunneling activity.
By focusing on behavioral deviations rather than static signatures, Kaspersky's KATA platform with its NAD capabilities provides a more robust defense against sophisticated, low-and-slow attacks. This approach is crucial for uncovering threats that leverage legitimate protocols and blend into the background noise of enterprise networks, offering a vital layer of security beyond traditional methods.
Kaspersky's implementation of NAD within KATA demonstrates a proactive strategy against evolving threat landscapes. The platform's ability to adapt detection models to specific network behaviors and protocols allows it to identify novel and evasive attack vectors, providing organizations with enhanced visibility and a stronger security posture against advanced persistent threats.