View source for Evading Microsoft ATA for Active Directory Domination

From BruCON 2017

← Evading Microsoft ATA for Active Directory Domination

You do not have permission to edit this page, for the following reasons:

The action you have requested is limited to users in the group: Users.
This page has been protected to prevent editing or other actions.

You can view and copy the source of this page.

Microsoft Advanced Threat Analytics (ATA) is a defense platform which reads information from multiple sources like traffic for certain protocols to the Domain Controller, Windows Event Logs and SIEM events. The information thus collected is used to detect Reconnaissance, Credentials replay, Lateral movement, Persistence attacks etc. Well known attacks like Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, Golden Ticket, Directory services replication, Brute-force, Skeleton key etc. can be detected using ATA. Whenever communication to a Domain Controller is done using protocols like Kerberos, NTLM, RPC, DNS, LDAP etc., ATA will parse that traffic for gathering information about not only possible attacks but user behavior as well. It slowly builds an organizational graph and can detect deviations from normal behavior.

Is it possible to evade this solid detection mechanism? What are the threats which ATA misses by design? How do Red Teamers and Penetration Testers can modify their attack chain and methodology to bypass ATA? Can we still have domain dominance?

Return to Evading Microsoft ATA for Active Directory Domination.

Retrieved from "https://2017.brucon.org/index.php/Evading_Microsoft_ATA_for_Active_Directory_Domination"

navigation

SEARCH

TOOLBOX

LANGUAGES

View source for Evading Microsoft ATA for Active Directory Domination

From BruCON 2017