Evading Microsoft ATA for Active Directory Domination

Evading Microsoft ATA for Active Directory Domination

Explore techniques for evading Microsoft Advanced Threat Analytics (ATA) in Active Directory environments in this Black Hat conference talk. Delve into ATA's functionality, threat detection capabilities, and lab configurations. Learn about user hunting, service principal scanning, and evasion methods using PowerView. Examine brute force attacks, golden ticket techniques, and constrained delegation vulnerabilities. Discover how to manipulate ATA's MongoDB, alter alert identities, and set visibility. Analyze ATA's limitations and discuss defensive strategies. Gain insights into avoiding detection and understanding the implications for Active Directory security.