Hacker Bypasses Microsoft ATA for Admin Access

Microsofts Advanced Threat Analytics defense platform can be cheated, a researcher will show at Black Hat USA next month.

Microsofts Advanced Threat Analytics (ATA) platform for detecting cyberattacks can be evaded by attackers to achieve organizational control, a security researcher has discovered.
ATA works by reading information from multiple sources: Windows Event Logs, SIEM events, and certain protocols to the Domain Controller. When communication to the Domain Control is done using protocols like Kerberos, NTLM, RPC, DNS, LDAP, etc., ATA parses the traffic to gather data about possible attacks and user behavior. ATA can detect known attacks like pass-the-hash, pass-the-ticket, Directory Services replication, brute-force, and skeleton key, for example.
But Nikhil Mattal, hacker for the Pentester Academy, found a way to bypass ATA and gain administrative access, which he will detail next month at Black Hat USA in Las Vegas in his session there,
Evading Microsoft ATA for Active Directory Domination
.
In the past couple of years, there have been increasing attacks on how Windows domain works, Mattal says. For example, if someone logs on to a desktop and their credentials are compromised, ATA will sense whether the user is logged on to multiple machines and send an alert.
Its also used to detect lateral movement across machines and throughout the corporate environment. ATA can be used to authenticate to different resources, driving the consequences of what could happen if the system were compromised.
Mattal calls ATA the new sheriff in town for enterprise security and many businesses still dont use it, but adds its among the most effective mechanisms for businesses today. This initial explanation of ATA will serve as a foundation for the crux of his talk, which will focus on how hackers can bypass ATA and achieve organizational dominance.
There are ways for cybercriminals to evade the detection capabilities of ATA, or avoid the system entirely, to launch dangerous attacks. If they can bypass ATA, its possible for them to gain domain administrative privileges and access each and every resource in the enterprise.
Attackers can slightly alter the so-called golden ticket attack, for example, to evade the detection capabilities of ATA and gain administrative privileges. ATA is designed to detect users trying to create a golden ticket to gain this level of access. However, attackers can bypass this by changing a packet in the Kerberos protocol used to connect with the Domain Controller.
ATA detects anomalies but by changing the structure of the golden ticket, it is possible to completely bypass it, Mattal explains, noting that attackers can use this to access data.
Consumer records, intellectual property … attackers can persist in that environment using the golden ticket and there would be no detection at all, he continues.
Mattal at Black Hat will dive into the technicalities of the golden ticket as well as other types of possible attacks against ATA and present live demonstrations of how they work. He says he has communicated his findings to Microsoft and is collaborating with its team to address the issues. Microsoft is working to push an update before Black Hat, and Mattal plans to adjust his presentation based on the progress there, he notes.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the
conference schedule
and
to register.

Related Content:
1 Million Endpoints Exposed on Public Internet via Microsoft File-Sharing Services
Most Organizations Not Satisfied with Threat Intelligence
How End-User Devices Get Hacked: 8 Easy Ways
Why Your AppSec Program Is Doomed to Fail & How to Save It

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Hacker Bypasses Microsoft ATA for Admin Access