Threat Intel Accelerates Detection and Response
Identifying the Exploit In November 2023, the Huntress team identified novel indicators of an attack where the threat actor used finger.exe (top portion illustrated in…
Category: ThreatIntelligence-IncidentResponse
The Health Sector is Under Attack. But You Can Fight Back.
In the first eight months of 2023, nearly 71.5M individuals’ health records had been breached. On top of this startling stat, 88% of surveyed healthcare…
Enterprise Patch & Remediation Benchmark 2026: How Do You Compare?
Executive Summary In the last 12 months, enterprises deployed millions of patches, yet many organizations remain exposed due to delayed remediation and unpatched third-party software.…
Solving Endpoint Security Challenges with a Managed EDR
Cybercriminals are some of the hardest working people around. For those of us who aren’t among the criminally inclined, a 40-hour work week is more…
Detection Guidance for ConnectWise CWE-288
UPDATE: Read our full analysis of CVE-2024-1709 & CVE-2024-1708 and detection guidance here. On February 19, 2024, ConnectWise released an advisory related to the disclosure of…
ConnectWise ScreenConnect CVE-2024-1709 & CVE-2024-1708
On February 19, 2024, ConnectWise published a security advisory for ScreenConnect version 23.9.8, referencing two vulnerabilities and software weaknesses. The same day, Huntress researchers worked…
Guide: How to Know if your ScreenConnect Server is Hacked
You’ve probably seen it by now, but there was a major ConnectWise ScreenConnect vulnerability (CVE-2024-1708 and CVE-2024-1709) – which we’re calling “SlashAndGrab” – that’s been…
Attacking MSSQL Servers, Pt. II
The Attack On February 8, 2024, Huntress published the first Attacking MSSQL Servers blog post. On February 23, a Huntress SOC analyst observed similar activity…
Navigate SocGholish with Huntress | Huntress
In an era where cyber threats like SocGholish are becoming increasingly sophisticated, understanding and combating these attacks is crucial for digital safety. This post delves…
Insights: RMM Tools | Huntress
Huntress lives in the small- to medium-sized business (SMB) space, partnering with managed service providers (MSPs), and as a result, sees a wide spectrum of…
Time Travelers Busted: How to Detect Impossible Travel
In this month’s Tradecraft Tuesday, our Developer Tech Lead Jamin Becker and Product Researcher Dave Kleinatland dove deep into the problem of Impossible Travel. Going…
Full Transparency: Controlling Apple’s TCC (Part 2)
In my last article, I gave an introduction to Apple’s Transparency, Consent, and Control (TCC) framework. The primary goal of TCC is to empower users…