The Power of People: Inside Huntress EDR and 24/7 Operations
Recently, the Huntress Security Operations Center (SOC) team spent some time talking about what makes our endpoint detection and response (EDR) solution—and the team behind…
Category: ThreatIntelligence-IncidentResponse
Advanced CyberChef Tips: AsyncRAT Loader
The Huntress SOC team encountered and investigated an infection involving a malicious malware loader on a Huntress-protected host. This investigation was initiated via persistence monitoring,…
The Battle for macOS Management: MDM vs. RMM
There are many ways to deploy software to macOS, and each comes with its own unique set of benefits and challenges. Outside of manually downloading…
Dirty Frag (CVE-2026-43284,CVE-2026-43500): Linux Kernel Privilege Escalation FAQ
Weeks after the Copy Fail vulnerability was revealed, a new Linux kernel escalation vulnerability has been uncovered. Dubbed “Dirty Frag,” this flaw could allow a…
Threat Advisory: XMRig Cryptomining By Way Of TeamViewer
At the end of May 2023, Huntress Security Operations Center (SOC) analysts responded to an alert on an endpoint, indicating the presence of a cryptocurrency…
MOVEit Transfer Critical Vulnerability CVE-2023-34362
UPDATED: 1 June 2023 @ 1733 ET – Added shareable Huntress YARA rule for assistance in detection effort UPDATED: 1 June 2023 @ 2023 ET…
Beware of Traitorware: Using Splunk for Persistence
In a previous blog post, I covered how Splunk, and by extension, other security tools, can be used for malicious purposes. In that specific example,…
Understanding GDAP and Its Operational Impact
You’ve likely heard that Microsoft has changed its Delegated Admin Privileges (DAP) authentication control to Granular Delegated Admin Privileges (GDAP). The transition is well underway,…
One MSP, Three Microsoft 365 Compromises, 72 Hours
Huntress has been hunting malicious actors across 50,000+ user accounts for 1,500+ small businesses enrolled in our Managed Identity Threat Detection and Response (ITDR) product.…
Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response — Elastic Security Labs
Introduction Self-hosted services exposed through a reverse proxy inevitably attract automated scanners probing for misconfigurations, admin panels, and vulnerable endpoints. In this article, I show…
Spring cleaning your browser | Red Canary
There’s something so satisfying about a good spring cleaning: the kind where you open the windows, clear the clutter, and finally deal with the things…
dmXProtect: Stop, Drop, Shut Malware Down
Note from the author: I’d be remiss not to mention the strangeness of the blog title, a simple but albeit ludicrous spin-off of a DMX…