Evading Microsoft ATA for Active Directory Domination

Explore techniques for evading Microsoft Advanced Threat Analytics (ATA) in Active Directory environments during this 50-minute conference talk from BruCON 0x09. Delve into ATA's defense mechanisms, including its ability to detect various attacks like Pass-the-Hash, Pass-the-Ticket, and Golden Ticket. Learn about potential vulnerabilities in ATA's design and discover how red teamers and penetration testers can modify their attack chains to bypass detection. Examine topics such as threat detection, user hunting, Kerberos ticket attacks, and MongoDB exploitation. Gain insights into defending and avoiding ATA, as well as understanding its limitations. Enhance your knowledge of Active Directory security and penetration testing methodologies in this comprehensive presentation.