--- title: How NAD in KATA detects Kerberoasting and DNS tunneling description: Network Anomaly Detection (NAD) in Kaspersky Anti Targeted Attack (KATA) uses SQL queries against a ClickHouse database to detect attacks that blend with... canonical: https://daily.dev/posts/how-nad-in-kata-detects-kerberoasting-and-dns-tunneling-06tkydusi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How NAD in KATA detects Kerberoasting and DNS tunneling | daily.dev og:description: Network Anomaly Detection (NAD) in Kaspersky Anti Targeted Attack (KATA) uses SQL queries against a ClickHouse database to detect attacks that blend with... og:url: https://daily.dev/posts/how-nad-in-kata-detects-kerberoasting-and-dns-tunneling-06tkydusi og:image: https://api.daily.dev/og/posts/06tKYDUsi.png og:image:alt: How NAD in KATA detects Kerberoasting and DNS tunneling og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How NAD in KATA detects Kerberoasting and DNS tunneling **[Securelist](https://daily.dev/sources/securelist)** · 19 min read · 0 upvotes · 0 comments ## Summary Network Anomaly Detection (NAD) in Kaspersky Anti Targeted Attack (KATA) uses SQL queries against a ClickHouse database to detect attacks that blend with legitimate traffic. Two attack techniques are examined in depth: Kerberoasting, where attackers request TGS tickets for service accounts with SPNs to crack passwords offline, and DNS tunneling, where data is encoded in subdomain strings and TXT records for covert C2 communication. Traditional signature-based IDS tools struggle with both because the traffic is indistinguishable from legitimate activity at the packet level. NAD rules instead correlate behavioral indicators — anomalous SPN request volumes per client, unusual data volumes in DNS TXT responses — to surface actionable alerts. The platform ships with 59 prebuilt rule templates across six categories (Large Data Transfers, Suspicious Connections, Domain Attacks, Reconnaissance Activity, Connections to Suspicious Resources, C2 Communication), all configurable via variables without modifying underlying SQL logic. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Kerberoasting Attack Explained Step by Step](https://daily.dev/posts/kerberoasting-attack-explained-step-by-step-n90us9ovx) · Latest Hacking News · 0 upvotes · 0 comments - [Command and Control & Tunnelling via DNS](https://daily.dev/posts/command-and-control-tunnelling-via-dns-whpd5zrfs) · InfoSec Write-ups · 0 upvotes · 0 comments - [HTB: Mirage](https://daily.dev/posts/htb-mirage-jymabso8x) · 0xdf hacks stuff · 1 upvotes · 0 comments - [Uplevelling Black Hat Threat Hunters](https://daily.dev/posts/uplevelling-black-hat-threat-hunters-ubgciohxp) · Cisco · 1 upvotes · 0 comments - [Extracting the How: Scaling Adversary Procedures Intelligence with AI](https://daily.dev/posts/extracting-the-how-scaling-adversary-procedures-intelligence-with-ai-9yazvficq) · Security Boulevard · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/how-nad-in-kata-detects-kerberoasting-and-dns-tunneling-06tkydusi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How NAD in KATA detects Kerberoasting and DNS tunneling","url":"https://daily.dev/posts/how-nad-in-kata-detects-kerberoasting-and-dns-tunneling-06tkydusi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-nad-in-kata-detects-kerberoasting-and-dns-tunneling-06tkydusi"},"datePublished":"2026-07-31T10:03:48.361Z","dateModified":"2026-07-31T10:04:17.449Z","description":"Network Anomaly Detection (NAD) in Kaspersky Anti Targeted Attack (KATA) uses SQL queries against a ClickHouse database to detect attacks that blend with...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f67882630c29b4b5828cfae15df2aa03?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f67882630c29b4b5828cfae15df2aa03?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-nad-in-kata-detects-kerberoasting-and-dns-tunneling-06tkydusi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT19M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"How NAD in KATA detects Kerberoasting and DNS tunneling"}]} ```