Celebrating One Year of Security Awareness Training
Today marks one year since Huntress announced the acquisition of Curricula, which is now Huntress Security Awareness Training. This acquisition was especially exciting for all…
Category: ThreatIntelligence-IncidentResponse
Business Email Compromise via Azure Administrative Privileges
Most of the time when you hear about business email compromise (BEC), you hear a single user account was compromised, leading to large amounts of…
ES|QL detection rules, generated from plain English by Elastic Security’s AI Agent — Elastic Security Labs
Elastic Security now includes AI-powered detection rule creation, built into the rule creation workflow. Analysts describe a threat behavior in plain English and receive a…
Entity Analytics Watchlists in Elastic Security: organizational risk context as a scoring signal — Elastic Security Labs
Elastic Security v9.4 introduces Entity Analytics Watchlists, a new capability in the Entity Analytics suite that lets security teams create named, weighted lists of users,…
Proactive threat hunting with Elastic’s AI-generated hunting leads — Elastic Security Labs
Threat hunting has always been a human art; a practitioner staring at logs, forming a hypothesis, and patiently chasing it down. What if the hardest…
UEBA & entity analytics: Why entity record quality matters — Elastic Security Labs
There’s an uncomfortable truth in security analytics that nobody talks about at conferences: The quality of your detections, alerts, and investigations is only as good…
Why Huntress Trusts Microsoft Defender Antivirus
Choosing the right antivirus (AV) tool can be a real headache. With so many options available, how do you know which one is the right…
Legitimate Apps as Traitorware for Persistent Microsoft
The idea of “persistence” in a cloud environment is not a well-studied topic. At most, you hear instances of the attacker creating backup logins to…
Elastic Conversational Entity Analytics for threat hunting — Elastic Security Labs
Entity Analytics is a core security analytics capability that extends Elastic Security from event-centric to entity-centric investigation. By focusing on critical entities, such as users,…
Another PaperCut: CVE-2023-39143 Remote Code Execution
On August 5, Huntress was made aware of the recently uncovered vulnerability tracked as CVE-2023-39143. For overall statistics, in our partner base we have over…
How Businesses Should Be Scaling Their Security
Small and medium businesses are changing their security stance for the better. There are still some stragglers, but they tend to be brought forward by…
How Security-Centric Procedures and Training Helped
On August 7, 2023, Huntress caught a business email compromise (BEC) that would have scammed us out of more than $100,000 had it gone undetected.…