Enumeration detection evasion

Enumeration can be a noisy process if tools are used without precautions. Also, defenders hunt for reconnaissance activities by using security products and deception methods. These methods are like a hidden bell in a dark room – you need to know where it is located to avoid detection. We will cover Microsoft ATA and its successor – Defender for Identity (MDI) together with honey tokens.

Microsoft ATA

Microsoft Advanced Threat Analytics (ATA) is an on-premises platform that helps to protect enterprises from threats. Extended support ends in 2026, so it makes sense to quickly cover it.

In this section, we will discuss only detections for recon methods; other attacks and bypasses will be covered in respective chapters. In general, ATA parses the network traffic of multiple protocols to detect malicious activity. It’s important to mention that it will take time for the tool to learn the normal behavior of the users and machines...