Endpoint Security In a macOS World
At the Worldwide Developer Conference (WWDC) in 2019, Apple announced the release of macOS Catalina and along with it, system extensions and, something they referred…
Category: ThreatIntelligence-IncidentResponse
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild — Elastic Security Labs
Introduction Recent Linux kernel privilege escalation vulnerabilities, Copy Fail (CVE-2026-31431) , Copy Fail 2, and DirtyFrag, highlight how subtle page cache corruption bugs can become…
The Power of People: Inside Huntress EDR and 24/7 Operations
Recently, the Huntress Security Operations Center (SOC) team spent some time talking about what makes our endpoint detection and response (EDR) solution—and the team behind…
Advanced CyberChef Tips: AsyncRAT Loader
The Huntress SOC team encountered and investigated an infection involving a malicious malware loader on a Huntress-protected host. This investigation was initiated via persistence monitoring,…
The Battle for macOS Management: MDM vs. RMM
There are many ways to deploy software to macOS, and each comes with its own unique set of benefits and challenges. Outside of manually downloading…
Dirty Frag (CVE-2026-43284,CVE-2026-43500): Linux Kernel Privilege Escalation FAQ
Weeks after the Copy Fail vulnerability was revealed, a new Linux kernel escalation vulnerability has been uncovered. Dubbed “Dirty Frag,” this flaw could allow a…
Threat Advisory: XMRig Cryptomining By Way Of TeamViewer
At the end of May 2023, Huntress Security Operations Center (SOC) analysts responded to an alert on an endpoint, indicating the presence of a cryptocurrency…
MOVEit Transfer Critical Vulnerability CVE-2023-34362
UPDATED: 1 June 2023 @ 1733 ET – Added shareable Huntress YARA rule for assistance in detection effort UPDATED: 1 June 2023 @ 2023 ET…
Beware of Traitorware: Using Splunk for Persistence
In a previous blog post, I covered how Splunk, and by extension, other security tools, can be used for malicious purposes. In that specific example,…
Understanding GDAP and Its Operational Impact
You’ve likely heard that Microsoft has changed its Delegated Admin Privileges (DAP) authentication control to Granular Delegated Admin Privileges (GDAP). The transition is well underway,…
One MSP, Three Microsoft 365 Compromises, 72 Hours
Huntress has been hunting malicious actors across 50,000+ user accounts for 1,500+ small businesses enrolled in our Managed Identity Threat Detection and Response (ITDR) product.…
Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response — Elastic Security Labs
Introduction Self-hosted services exposed through a reverse proxy inevitably attract automated scanners probing for misconfigurations, admin panels, and vulnerable endpoints. In this article, I show…