Full Report
An analysis of how Network Anomaly Detection (NAD) rules work within Kaspersky Anti Targeted Attack, using Kerberoasting and DNS tunneling attacks as examples.
Analysis Summary
Based on the analysis of the techniques and procedures described in the Kaspersky Anti Targeted Attack (KATA) report, here is the summary of the highlighted attack tools and techniques.
# Tool/Technique: Kerberoasting & DNS Tunneling
## Overview
This report focuses on two distinct network-based attack vectors: **Kerberoasting**, used for credential theft and lateral movement within Active Directory environments, and **DNS Tunneling**, used for bypassing network security controls to establish Command and Control (C2) or exfiltrate data.
## Technical Details
- **Type**: Technique / Attack Frameworks
- **Platform**: Windows (Active Directory), Cross-platform (DNS Tunneling)
- **Capabilities**: Credential harvesting, protocol encapsulation, data exfiltration, and stealthy C2 communication.
- **First Seen**: Kerberoasting (2014); DNS Tunneling (Early 2000s)
## MITRE ATT&CK Mapping
- **TA0006 - Credential Access**
- **T1558.003 - Stealing or Forging Kerberos Tickets: Kerberoasting**
- **TA0011 - Command and Control**
- **T1071.004 - Application Layer Protocol: DNS**
- **T1572 - Protocol Tunneling**
- **TA0010 - Exfiltration**
- **T1048 - Exfiltration Over Alternative Protocol**
## Functionality
### Core Capabilities
* **Kerberoasting**: Exploits the Kerberos protocol by requesting a service ticket (TGS) for a Service Principal Name (SPN). The ticket is encrypted with the service account’s password hash, allowing for offline brute-forcing.
* **DNS Tunneling**: Encapsulates non-DNS traffic (such as HTTP or SSH) within DNS queries and responses (typically using TXT, CNAME, or NULL records) to bypass firewalls that allow outbound DNS traffic.
### Advanced Features
* **Automation**: Modern tools like **Rubeus** or **Impacket** automate the scanning of SPNs and the extraction of crackable hashes.
* **Encoding/Encryption**: DNS Tunneling tools (e.g., **iodine**, **dnscat2**) use custom encoding (Base32/64) and encryption to hide the payload within the DNS packet structure.
## Indicators of Compromise
* **Network Indicators**:
* `dnscat[.]com` (Common default for dnscat2)
* `tunnel[.]com` (Example domain)
* High volume of DNS requests to a single unusual domain.
* Frequent DNS TXT or NULL record queries.
* **Behavioral Indicators**:
* **Kerberoasting**: An unusual spike in `TGS-REQ` (Service Ticket Requests) using RC4 encryption (Type 0x17) specifically targeting service accounts.
* **DNS Tunneling**: Abnormally long subdomains (over 64 characters) and high frequency of "NXDOMAIN" responses.
## Associated Threat Actors
* **Kerberoasting**: Used by nearly all sophisticated actors including **APT29 (Cozy Bear)** and **FIN7**.
* **DNS Tunneling**: Frequently used by **OilRig (APT34)**, **DarkHydrus**, and **APT41**.
## Detection Methods
* **Behavioral Detection**:
* Monitoring for a high volume of Kerberos TGS requests from a single source targeting multiple services within a short timeframe.
* Analyzing DNS entropy; tunneling traffic typically exhibits higher randomness in query strings.
* **Heuristic Analysis**:
* Identifying mismatches between DNS packet size and standard protocol behavior.
* Detection of RC4 encryption in Kerberos tickets, which is more susceptible to cracking than AES.
## Mitigation Strategies
* **Hardening**:
* Use long, complex passwords (25+ characters) for service accounts or transition to **Group Managed Service Accounts (gMSA)**.
* Enforce AES encryption for Kerberos and disable legacy RC4 support.
* **Prevention**:
* Implement DNS filtering and inspection to block requests to known malicious or "newly seen" domains.
* Restrict outbound DNS traffic to authorized internal DNS servers only.
## Related Tools/Techniques
* **Tools**: Rubeus, Impacket (GetUserSPNs.py), dnscat2, iodine, Cobalt Strike (DNS Beacons).
* **Techniques**: AS-REP Roasting, Golden Ticket attacks, DNS Hijacking.