What Is a Persistent Foothold?
Before Huntress, I always assumed that threat hunting was done like this: Gather as much visibility as you could afford Make sure it includes sophisticated…
Category: ThreatIntelligence-IncidentResponse
Scale Your Security Operations with Confidence
If there’s one thing we know about hackers, it’s that they stay busy. In fact, hackers launch an attack every 39 seconds. That adds up…
From PowerShell to Payload: An Analysis of Weaponized Malware
Click, boom, and your network is compromised. All a hacker needs is one successful exploit and you could have a very bad day. Recently, we…
7 Takeaways from the Executive Order on Improving Cybersecurity
On May 12, 2021, President Biden signed an Executive Order (EO) to improve U.S. cybersecurity standards and further combat cyber threats against the nation. Though…
Cyber Security Insurance Perspective on Ransomware
It’s not the first time I’ve seen something like this happen, and it certainly won’t be the last. During my time as an auditor at…
Endpoint Protection: Promises vs. Reality
One of the major challenges in the cybersecurity industry is that vendors tend to overpromise and underdeliver. I see it time and time again. In…
How a College Student Lost $10,000 to “The IRS”
Back when I worked in the division of student affairs, I came across an unsettling report from our university’s police department. One of my students…
Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix
Acknowledgments:A special thank you to Tyler Bohlmann, Jon Semon, Lindsey O’Donnell-Welch, Aaron Deal, and Beth Robinson for their contributions and edits to this blog. And…
Discovering a Ransomware Remedy in the Wild
Within the ThreatOps department at Huntress, we actively hunt for malware and adversary activity. We look for persistent footholds: the tell-tale sign and smoking gun…
How Are Hackers Sneaking Past Your Automated Systems?
Many organizations today rely on preventive software and automation to keep cybersecurity threats at bay. Unfortunately, it’s just not enough to keep hackers away. Human…
Creating a Better Why for Cyber Security Awareness Training
The game has changed for employee cyber security awareness training. For most organizations, the reason why they implemented a security awareness training program was to…
Google Threat Intelligence in Elastic Security — Elastic Security Labs
Elastic Security natively ingests Google Threat Intelligence: known-malicious IPs, domains, URLs, and file hashes matched against your telemetry the moment they appear, each carrying a…