Listen to this Post
A New Layer of Visibility Against Quiet Attacks
Some of the most dangerous cyberattacks do not arrive with obvious malware, crashing servers, or a flood of suspicious traffic. They hide inside legitimate protocols, imitate normal administrative activity, and wait for defenders to overlook the small changes that reveal what is really happening.
That is where network anomaly detection becomes especially important. A new technical discussion highlighted by Cybersecurity News Everyday examines how Kaspersky Anti Targeted Attack, commonly known as KATA, can use Network Anomaly Detection rules to identify suspicious behavior associated with Kerberoasting and DNS tunneling.
The approach is significant because both techniques can blend into ordinary enterprise traffic. Kerberos is a normal and essential authentication protocol in Windows environments, while DNS is one of the most universally permitted services on a corporate network. Attackers can therefore abuse protocols that defenders cannot simply block.
Kaspersky’s documentation confirms that KATA’s Network Anomaly Detection system analyzes protocol attributes from network sessions and supports rule-based analysis for protocols including DNS, Kerberos, LDAP and DCE/RPC. The platform can use predefined templates as well as SQL-based rules to search those attributes for unusual patterns.
Why These Attacks Are Difficult to Spot
The central challenge is not simply detecting malicious traffic. It is separating malicious activity from legitimate activity that looks almost identical.
An employee requesting a Kerberos service ticket can be completely normal. A server generating thousands of DNS queries can also be normal. A security product that simply looks for high volumes would generate an overwhelming number of false positives.
The more useful question is different: Does this activity make sense for this particular host, account, service, and time period?
That shift from simple signature matching toward behavioral analysis is one of the most important ideas behind modern Network Detection and Response platforms.
What Is Kaspersky Anti Targeted Attack?
Kaspersky Anti Targeted Attack is designed to detect sophisticated attacks across enterprise environments. Kaspersky describes KATA as a platform combining network traffic analysis, anomaly detection, sandboxing, intrusion detection and response capabilities to provide visibility into complex attacks.
The platform can analyze mirrored network traffic and network metadata and is designed to identify suspicious behaviors such as lateral movement, command-and-control activity and data exfiltration.
This makes Network Anomaly Detection particularly valuable because it can identify activity that does not necessarily match a known malicious signature.
Kerberoasting Turns a Legitimate Protocol Into an Attack Surface
Kerberoasting is a technique that abuses the way Kerberos service authentication works in Active Directory environments.
In simplified terms, an attacker who already has some level of domain access can identify accounts associated with service principal names and request service tickets. Those tickets can potentially provide material that attackers attempt to crack offline, particularly when service accounts are protected by weak or predictable passwords.
The dangerous part is that requesting a Kerberos service ticket is not inherently malicious.
Kerberos is supposed to issue tickets.
That means defenders cannot simply treat every service-ticket request as an intrusion. Detection must instead consider patterns such as unusual enumeration, abnormal request volumes, suspicious account behavior and deviations from established network activity.
Why Behavioral Detection Matters for Kerberoasting
A traditional security control might recognize known malicious software associated with an attack.
But an attacker does not necessarily need special malware to abuse Kerberos.
They may use legitimate operating-system capabilities or commonly available security-testing tools, making the network behavior itself an important source of evidence.
KATA’s Network Anomaly Detection rules provide a mechanism for analyzing Kerberos protocol attributes stored from network sessions. Kaspersky’s documentation specifically identifies Kerberos as one of the supported protocols for anomaly rules.
That gives defenders another opportunity to notice suspicious behavior before an attacker reaches a more damaging stage.
DNS Tunneling Hides Data Inside Normal-Looking Traffic
DNS tunneling represents a different problem.
DNS exists almost everywhere. Workstations need it, servers need it, applications need it, and security infrastructure frequently depends on it.
Because DNS traffic is so fundamental, completely blocking it is rarely realistic.
Attackers can exploit that trust by encoding information into DNS requests or responses, using DNS as a covert communication channel for command-and-control activity or potential data movement.
The traffic may technically consist of DNS queries, but the underlying pattern can be abnormal.
The Clues Hidden Inside DNS Behavior
DNS tunneling can produce several characteristics that deserve investigation.
Repeated queries to unusual domains can be suspicious.
Very long or unusually structured subdomains can deserve attention.
High-frequency requests from a workstation that normally generates little DNS traffic can be another warning sign.
Random-looking labels, unusual query distributions, abnormal response patterns and repeated communication with uncommon destinations can also contribute to a stronger detection signal.
None of these characteristics automatically proves compromise.
That distinction is critical.
Good anomaly detection is about combining multiple weak indicators until they become strong enough to justify investigation.
KATA’s Rule-Based Approach
Kaspersky’s documentation describes Network Anomaly Detection rules as searches over protocol attributes collected from registered network sessions.
The platform stores those attributes in a dedicated database and uses SQL queries to perform rule-based analysis. Kaspersky says built-in templates can be used to create rules, while administrators can also generate or modify SQL queries for specialized detection requirements.
This is an important design choice.
Instead of treating anomaly detection as an entirely opaque process, KATA gives security teams a way to define specific detection logic around the traffic they care about.
SQL Becomes Part of the Detection Layer
SQL may not be the first technology people associate with threat detection, but it can be extremely useful when security telemetry is stored in a structured database.
KATA’s documentation states that its Network Anomaly Detection queries use ClickHouse and can work with protocol-specific fields, including structured DNS and Kerberos data.
That means defenders can build detection logic around measurable attributes rather than relying exclusively on malware signatures.
For example, a defensive rule can conceptually ask whether a particular combination of protocol behavior, frequency, destination characteristics and time window crosses a defined threshold.
Deep Analysis: Detection Logic and Defensive Commands
The word “commands” should be understood here from a defensive perspective. The important element is not giving attackers instructions for conducting Kerberoasting or DNS tunneling, but showing how security teams can think about detection logic.
A safe conceptual workflow looks like this:
Collect network sessions
↓
Extract DNS and Kerberos attributes
↓
Store protocol metadata
↓
Apply anomaly-detection rules
↓
Compare behavior against thresholds
↓
Generate security events
↓
Investigate the affected host/account
↓
Correlate with EDR, SIEM and identity logs
KATA supports this type of rule-based workflow, with configurable search depth, schedules, thresholds and event generation.
Defenders can therefore think in terms of safe analytical commands such as:
QUERY → identify unusual Kerberos patterns
FILTER → isolate abnormal DNS behavior
COMPARE → evaluate activity against normal baselines
CORRELATE → connect network activity with endpoint and identity telemetry
ALERT → escalate high-confidence anomalies
CONTAIN → isolate affected systems when justified
These are not attack instructions. They represent the defensive sequence security operations teams can use when investigating suspicious network behavior.
Reducing False Positives Is Half the Battle
Detection is only useful when analysts can trust it.
A system that generates thousands of alerts every day can become nearly as problematic as a system that detects nothing.
Kaspersky’s architecture allows administrators to create rules with search intervals and thresholds, while dictionaries can also be used to provide values for SQL query variables.
This gives security teams opportunities to tune detection to their own environment.
A DNS server, for example, should naturally generate significantly more DNS traffic than an ordinary employee workstation.
Likewise, a domain controller will have a very different Kerberos profile from a printer, database server or laptop.
Context matters.
The Importance of Establishing a Baseline
Anomaly detection becomes much more powerful when defenders understand what “normal” looks like.
A workstation that suddenly begins making thousands of unusual DNS requests is more interesting if it normally makes only a small number.
An employee account suddenly associated with unusual Kerberos service-ticket activity may deserve attention if that account has never demonstrated similar behavior.
A server communicating with a completely new collection of domains can become more suspicious when that activity occurs simultaneously with an unusual process or authentication event.
The strongest detections therefore combine deviation with context.
Why DNS and Kerberos Are Especially Important
Both protocols occupy privileged positions in enterprise infrastructure.
Kerberos sits near the center of identity and authentication in many Active Directory environments.
DNS sits at the foundation of network communication.
That creates an uncomfortable reality for defenders: the protocols that attackers abuse are often the same protocols businesses cannot simply turn off.
The goal therefore has to be visibility rather than elimination.
Attackers Prefer the Noise of Normal Operations
Modern attackers understand that obvious behavior attracts attention.
Launching an unknown executable is suspicious.
Sending traffic to an obviously malicious IP address is suspicious.
Creating a strange network protocol that no one has seen before is suspicious.
Abusing an ordinary enterprise protocol can be much harder to notice.
This is why behavioral detection has become increasingly important in security operations.
KATA Looks Beyond Individual Packets
Network anomaly detection is more useful when it considers traffic as a sequence of events rather than isolated packets.
One DNS request might mean nothing.
One Kerberos request might mean nothing.
Hundreds of unusual requests in a particular sequence can tell a very different story.
The ability to store protocol attributes and analyze them over defined time intervals allows defenders to look for those larger behavioral patterns.
Network Anomaly Detection Is Not a Magic Button
It is important not to overstate what KATA can accomplish.
An anomaly alert is not automatically proof that an attack has occurred.
Legitimate software can generate unusual DNS traffic.
Administrators can generate unusual Kerberos activity.
Large environments can produce behavior that looks anomalous simply because of infrastructure changes.
This is why anomaly detection should be treated as an investigative signal rather than an automatic verdict.
The Role of the Security Operations Center
For a SOC, the value of Network Anomaly Detection is the additional visibility it provides.
Kaspersky describes KATA as integrating network visibility with other detection and response capabilities, including endpoint and SIEM-related integrations.
That creates the possibility of connecting multiple pieces of evidence.
Network telemetry can show what happened.
Endpoint telemetry can show which process was involved.
Identity logs can show which account was used.
DNS records can show where the system was communicating.
Together, those signals can transform an isolated anomaly into a coherent incident narrative.
Correlation Makes Weak Signals Stronger
Consider a hypothetical investigation.
A workstation begins generating unusual DNS queries.
At almost the same time, the same workstation demonstrates abnormal Kerberos activity.
An endpoint alert then identifies a suspicious process.
The identity system records unusual authentication behavior.
Individually, each event might be explainable.
Together, the probability of malicious activity becomes considerably more concerning.
This is where NDR, EDR and SIEM technologies complement one another rather than compete with one another.
Why East-West Traffic Matters
Many organizations still focus heavily on traffic entering and leaving their networks.
But once an attacker compromises one machine, the internal network can become the real battlefield.
Attackers may move laterally, search for credentials, access services and communicate with internal infrastructure.
Kaspersky specifically describes
That internal visibility is particularly relevant for techniques involving Active Directory and enterprise authentication.
The Human Element Still Matters
Even sophisticated detection systems depend on skilled analysts.
A rule can identify an unusual event.
It cannot always explain why the event happened.
An analyst still needs to determine whether the behavior came from an administrator, a newly deployed application, a legitimate service, a compromised account or an attacker.
Automation reduces the amount of work.
It does not eliminate the need for judgment.
What Security Teams Should Monitor
Organizations concerned about Kerberoasting should pay attention to unusual Kerberos service-ticket behavior, unexpected service-account activity, abnormal authentication patterns and signs of account enumeration.
For DNS tunneling, defenders should watch for unusual query volumes, suspicious domain patterns, abnormal subdomain structures, unexpected destinations and hosts whose DNS behavior changes dramatically.
These indicators become substantially more useful when combined with endpoint and identity telemetry.
Service Accounts Remain a Critical Security Concern
Kerberoasting also highlights an old but persistent security problem: service-account credentials.
If a service account has excessive privileges and a weak password, compromising that account can have consequences far beyond the original machine.
Organizations should therefore minimize service-account privileges, use strong randomly generated credentials where appropriate, review service principal names and eliminate unnecessary accounts.
Detection is important.
Prevention is better.
DNS Visibility Should Not Be Ignored
DNS often receives less attention than HTTP, email or endpoint telemetry.
That is a mistake.
Because DNS is so widely permitted, it can become an attractive communication channel for malicious activity.
Centralizing DNS logs, monitoring unusual patterns and understanding which systems should communicate with external resolvers can significantly improve visibility.
Built-In Rules Can Accelerate Deployment
One advantage of
Kaspersky documents built-in Network Anomaly Detection templates that can be used as starting points for customized SQL queries.
This can shorten the path from deployment to useful detection.
Security teams can begin with established logic and then adapt thresholds to their environment.
Custom Rules Can Reflect Local Reality
Every organization has different traffic patterns.
A university network does not look like a bank.
A manufacturing environment does not look like a software company.
A hospital does not have the same authentication patterns as a cloud-native startup.
Custom rules allow organizations to account for those differences.
The goal should not be to create the most aggressive detection system possible.
The goal should be to create a detection system that understands the organization’s normal behavior well enough to identify meaningful deviations.
Search Depth Changes Detection Quality
KATA’s Network Anomaly Detection rules operate across configurable time intervals, known in the documentation as search depth.
That matters because an anomaly can appear very different depending on the observation window.
A five-minute burst may look insignificant across an entire day.
The same burst can become highly suspicious when viewed alongside other events occurring during that period.
Time is therefore part of the detection signal.
Detection Gaps Can Create False Confidence
Security teams sometimes assume that having an NDR platform means the network is fully monitored.
That assumption can be dangerous.
Traffic visibility depends on architecture, sensor placement, encrypted traffic, network segmentation and the quality of available metadata.
KATA can provide powerful analysis, but organizations still need to ensure that important network segments are actually visible to the platform.
Encryption Does Not Eliminate the Need for Metadata
Modern networks increasingly rely on encryption.
That makes deep inspection more difficult in many situations.
But attackers still leave behavioral traces.
Connection timing, destination patterns, protocol metadata, frequency and relationships between systems can remain useful even when payload contents are unavailable.
This is another reason anomaly-based detection is increasingly important.
A Stronger Defense Comes From Multiple Layers
The most effective security strategy is unlikely to depend on a single detection technology.
Network anomaly detection can identify unusual traffic.
EDR can reveal suspicious processes.
Identity monitoring can expose abnormal account activity.
SIEM can correlate events across the environment.
Threat intelligence can add external context.
Together, these layers create a much stronger defense than any individual product operating alone.
The Bigger Lesson From Kerberoasting
Kerberoasting demonstrates that an attacker does not always need to break a protocol to abuse it.
Sometimes the attacker simply uses the protocol as designed and manipulates the surrounding conditions.
That makes behavioral detection essential.
The question is no longer just, “Is this protocol being used?”
It becomes, “Is this protocol being used in a way that makes sense?”
The Bigger Lesson From DNS Tunneling
DNS tunneling delivers a similar lesson.
Blocking DNS is unrealistic.
Ignoring DNS is dangerous.
The answer is visibility, context and behavioral analysis.
When organizations understand how their DNS traffic normally behaves, unusual activity becomes easier to identify.
Why This Matters in 2026
Cybersecurity operations in 2026 are increasingly dealing with attackers who understand traditional detection mechanisms.
Malware signatures remain valuable, but sophisticated intrusion campaigns can combine legitimate tools, compromised credentials and normal enterprise protocols.
That pushes defenders toward a more behavioral model.
KATA’s Network Anomaly Detection architecture reflects that broader movement toward detecting deviations in legitimate network activity rather than waiting for a recognizable malicious file.
What Undercode Say:
The Real Battle Is Happening Inside Normal Traffic
The most important takeaway is that modern attacks increasingly hide inside legitimate infrastructure. Kerberos and DNS are not suspicious technologies. They are essential technologies. That is precisely why attackers find them useful.
Anomaly Detection Changes the Question
Traditional detection asks whether traffic matches something known to be malicious. Anomaly detection asks whether the traffic makes sense. That difference can be extremely valuable against previously unseen or customized attack activity.
Kerberoasting Is a Visibility Problem
Organizations cannot simply disable Kerberos to eliminate Kerberoasting. They need to understand which accounts request which services and whether the behavior is consistent with the user’s normal role.
DNS Is Too Important to Block
DNS tunneling demonstrates the same dilemma. Businesses need DNS, so defenders must monitor it instead of treating it as inherently trustworthy.
Context Is More Important Than Volume
A large amount of traffic is not necessarily malicious. A small amount of traffic can be extremely important if it represents a dramatic deviation from normal behavior.
SQL-Based Detection Is Interesting
Using SQL to analyze protocol metadata gives security teams a relatively transparent way to express detection logic. Analysts can understand what the rule is looking for and adjust it when the environment changes.
Detection Rules Need Maintenance
A rule that works perfectly today may generate noise six months later after an infrastructure migration, application rollout or organizational change. Detection engineering must therefore be treated as an ongoing process.
False Positives Can Destroy Detection Programs
If analysts receive too many low-quality alerts, they eventually begin ignoring alerts. This makes precision just as important as detection coverage.
NDR Complements EDR
Endpoint monitoring cannot see everything, particularly when unmanaged or specialized devices are involved. Network monitoring can provide visibility where endpoint agents cannot.
Identity and Network Data Belong Together
Kerberoasting is fundamentally connected to identity. DNS tunneling is fundamentally connected to network behavior. Combining both perspectives creates a stronger investigative picture.
East-West Visibility Is Critical
Once an attacker enters an organization, internal movement can become more important than the original intrusion vector. Monitoring internal traffic can therefore expose activity that perimeter-focused defenses miss.
Attackers Benefit From Normality
The more legitimate a protocol looks, the easier it can be for malicious activity to hide inside it. This is why behavioral anomalies deserve serious attention.
Baselines Must Be Specific
There is no universal definition of normal network behavior. A domain controller, workstation and application server should not have identical profiles.
Threat Hunting Can Start With Anomalies
Security teams do not always need an IOC before beginning an investigation. A significant deviation from expected behavior can be enough to start hunting.
Automated Detection Should Trigger Investigation
An alert should lead analysts toward evidence, not automatically declare guilt. That distinction helps prevent legitimate activity from becoming an incident.
The Best Detection Is Layered
A network anomaly becomes much more valuable when correlated with endpoint, identity, DNS and SIEM evidence.
KATA’s Architecture Reflects This Trend
Kaspersky positions KATA as a broader platform combining network visibility, anomaly detection, sandboxing, IDS and response capabilities rather than relying on one detection mechanism.
Security Teams Should Think in Sequences
A single event may be harmless. A sequence of events can reveal an attack. This is one of the strongest arguments for behavioral analytics.
Network Telemetry Is Becoming More Valuable
As endpoint and cloud environments become increasingly complex, defenders need additional sources of evidence. Network telemetry can provide that missing perspective.
The Goal Is Earlier Detection
The ultimate advantage of anomaly detection is not simply generating another alert. It is potentially identifying suspicious activity before it develops into credential theft, lateral movement or data exfiltration.
The Most Important Word Is Deviation
Attackers can imitate legitimate behavior, but perfectly reproducing the historical behavior of every host, account and service is much harder. Deviations therefore remain an important defensive signal.
KATA Is Not a Substitute for Security Hygiene
Strong passwords, privileged-access controls, segmentation, patching, identity protection and endpoint security remain fundamental. Detection should be the safety net, not the only defense.
Kerberoasting Should Encourage Service-Account Reviews
Organizations should regularly review service accounts, their privileges, password strength and associated service principal names.
DNS Monitoring Should Become Routine
DNS should be treated as security telemetry rather than merely infrastructure data.
Detection Engineering Is the Next Step
Organizations should move beyond simply deploying security products and begin continuously improving the rules that interpret their telemetry.
The Human Analyst Remains Essential
Technology can find the anomaly. Analysts determine its meaning.
The Bigger Security Lesson
Attackers do not always need unusual technology. Sometimes they only need legitimate technology used in an unusual way.
Why This Research Matters
The KATA example illustrates a broader security principle: visibility into normal protocols can be just as important as detection of malicious software.
The Defensive Advantage
If defenders can identify deviations early, they may have an opportunity to investigate an intrusion before the attacker reaches higher-value systems.
The Remaining Challenge
Sophisticated attackers will continue adapting their behavior to blend into legitimate activity. Detection systems must therefore evolve continuously.
The Final Undercode View
Kaspersky’s Network Anomaly Detection approach is particularly interesting because it focuses on the behavior surrounding two protocols attackers can abuse without making those protocols themselves suspicious.
The strongest security strategy is not to distrust everything.
It is to understand normal behavior deeply enough that abnormal behavior becomes difficult to hide.
✅ KATA Supports Network Anomaly Detection Rules
Kaspersky’s official documentation confirms that KATA supports Network Anomaly Detection rules and analyzes protocol attributes from network sessions. DNS and Kerberos are explicitly among the supported protocols.
✅ SQL-Based Analysis Is Officially Documented
Kaspersky confirms that Network Anomaly Detection rules can use SQL queries, with ClickHouse supporting the analysis of stored network-session and protocol attributes.
⚠️ Kerberoasting and DNS-Tunneling Detection Should Be Interpreted Carefully
The supplied post summarizes KATA as detecting Kerberoasting and DNS tunneling, but the available official documentation primarily confirms the underlying Network Anomaly Detection framework and its support for DNS and Kerberos. A specific rule’s exact detection logic and effectiveness should therefore be validated against the original technical implementation rather than assumed from the short social-media summary.
Prediction
(+1) Behavioral Network Detection Will Become More Important
As attackers increasingly abuse legitimate credentials, operating-system capabilities and common enterprise protocols, security teams will place greater emphasis on behavioral analytics and anomaly detection.
(+1) DNS and Identity Monitoring Will Converge
DNS telemetry and identity activity will increasingly be correlated because attackers can use both domains and authentication mechanisms during the same intrusion.
(+1) Custom Detection Rules Will Grow in Importance
Organizations will increasingly customize detection thresholds around their own infrastructure instead of relying entirely on universal rules.
(+1) NDR and EDR Will Work More Closely Together
Network and endpoint telemetry provide different perspectives on the same attack. Their combination will become increasingly important for investigating sophisticated intrusions.
(+1) Detection Engineering Will Become a Core SOC Function
Security teams will increasingly treat detection rules as living security controls that require testing, tuning and continuous improvement.
Final Assessment: Quiet Attacks Are the Ones Defenders Should Fear
The most dangerous network activity is not always the loudest.
A strange executable may be easy to find.
A ransomware process may trigger multiple alarms.
A clearly malicious connection may be blocked automatically.
But an attacker quietly abusing Kerberos or hiding communications inside DNS can look surprisingly ordinary.
That is why the KATA Network Anomaly Detection approach is worth watching.
The broader lesson extends far beyond one security platform: when attackers hide inside legitimate protocols, defenders need to understand behavior rather than simply search for known malicious signatures.
Kaspersky’s documentation shows that KATA provides the underlying capabilities to analyze DNS, Kerberos and other protocol attributes, apply rule-based SQL analysis and generate events from detected anomalies.
For security teams, the message is straightforward.
Know what normal looks like.
Monitor the deviations.
Correlate the evidence.
And investigate the quiet signals before they become a major incident.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: x.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
