Network Anomaly Detection in KATA

July 31, 2026 · Kaspersky (Securelist) · Severity: MEDIUM

Kaspersky KATA detects network anomalies like Kerberoasting and DNS tunneling that are indistinguishable from legitimate traffic.

Key Takeaways

Introduction Once the attacker has breached the corporate network, subsequent stages of the attack often involve leveraging standard domain infrastruc.
Because this activity is virtually indistinguishable from legitimate network traffic, it is extremely difficult to detect it with traditional network.
Kerberoasting and DNS tunneling have long ceased to be exotic techniques.