Network Anomaly Detection (NAD) in Kaspersky Anti Targeted Attack (KATA) uses SQL queries against a ClickHouse database to detect attacks that blend with legitimate traffic. Two attack techniques are examined in depth: Kerberoasting, where attackers request TGS tickets for service accounts with SPNs to crack passwords offline, and DNS tunneling, where data is encoded in subdomain strings and TXT records for covert C2 communication. Traditional signature-based IDS tools struggle with both because the traffic is indistinguishable from legitimate activity at the packet level. NAD rules instead correlate behavioral indicators — anomalous SPN request volumes per client, unusual data volumes in DNS TXT responses — to surface actionable alerts. The platform ships with 59 prebuilt rule templates across six categories (Large Data Transfers, Suspicious Connections, Domain Attacks, Reconnaissance Activity, Connections to Suspicious Resources, C2 Communication), all configurable via variables without modifying underlying SQL logic.
