Evaded Microsoft ATA

### Offensive Evasion of Microsoft Advanced Threat Analytics At 00:00, security researcher Siyu Zhu presents offensive research exploring evasion techniques against Microsoft Advanced Threat Analytics (ATA), an enterprise behavioral detection platform protecting Active Directory domain controllers.

### Microsoft ATA Sensor Architecture and Traffic Inspection At 07:02, Zhu outlines ATA's deployment model. Operating via lightweight sensor agents installed on domain controllers, ATA inspects network traffic (Kerberos, DNS, RPC, NTLM) and Windows security event logs to detect adversarial reconnaissance and credential abuse.

### Circumventing Pass-the-Hash and Lateral Movement Detections At 14:01, the speaker analyzes ATA's credential harvesting detections. He demonstrates how ATA detects suspicious NTLM authentication and Pass-the-Hash attacks from tools like Mimikatz, and details network timing tweaks that blend lateral movement into normal administrative traffic patterns.

### Evading Kerberos Golden Ticket and PAC Alerts At 21:00, Zhu exposes bypasses targeting ATA's Kerberos anomaly heuristics. By matching encryption types (AES-128/256 rather than RC4), calibrating ticket expiration timestamps to match domain policy, and forging matching Privilege Attribute Certificates (PAC), attackers can generate Golden Tickets without triggering alerts.

### MS14-068 Privilege Escalation and Log Analysis Evasion At 28:00, the presentation details weaponizing the MS14-068 Kerberos vulnerability while suppressing event log anomalies, demonstrating how attackers gain domain administrator privileges without alerting ATA sensors.

### Blue Team Detection Hardening Concluding at 35:01, Zhu provides recommendations for enterprise defenders. He advises enabling Kerberos FAST armoring, auditing Event ID 4768 and 4769 ticket requests, and pairing network sensor analytics with dedicated host-level endpoint detection (EDR) on domain controllers.

(AI summary — Gemini Flash)