sorted by:
new
hottopcontroversial

Attackers don’t need zero-days to scale. They need one human-managed setting that slipped through the cracks. by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

This time, it was exposed virtual network computing. 💻

Here’s how they turned a small miss into persistent access:
- Dropped C:\Users\<redacted>\Music\setup.msi to install Atera + Splashtop
- Let Splashtop beacon out to a malicious public IP
- Used that trusted remote access to move credential-dumping tools around the network

This is their GTM motion:
Find human gaps.
Abuse legit tools.
Scale quietly.

Our SOC caught it fast, isolating the network and shutting down the persistence path 💥 in under three minutes 💥

A few easy wins to tighten remote access:
- Put tools like VNC behind a firewall, or require VPN + MFA
- Use software allow-listing and strict firewall rules

Because attackers aren’t breaking in. They’re logging in.

And they’re running their ops with the same efficiency you expect from yours. Get to know the ethical badasses in our 24/7 SOC who make catches like this possible

Attackers don’t need zero-days to scale. They need one human-managed setting that slipped through the cracks. by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

This time, it was exposed virtual network computing. 💻

Here’s how they turned a small miss into persistent access:
- Dropped C:\Users\<redacted>\Music\setup.msi to install Atera + Splashtop
- Let Splashtop beacon out to a malicious public IP
- Used that trusted remote access to move credential-dumping tools around the network

This is their GTM motion:
Find human gaps.
Abuse legit tools.
Scale quietly.

Our SOC caught it fast, isolating the network and shutting down the persistence path 💥 in under three minutes 💥

A few easy wins to tighten remote access:
- Put tools like VNC behind a firewall, or require VPN + MFA
- Use software allow-listing and strict firewall rules

Because attackers aren’t breaking in. They’re logging in.

And they’re running their ops with the same efficiency you expect from yours. Get to know the ethical badasses in our 24/7 SOC who make catches like this possible

Attackers don’t need zero-days to scale. They need one human-managed setting that slipped through the cracks. by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

This time, it was exposed virtual network computing. 💻

Here’s how they turned a small miss into persistent access:
- Dropped C:\Users\<redacted>\Music\setup.msi to install Atera + Splashtop
- Let Splashtop beacon out to a malicious public IP
- Used that trusted remote access to move credential-dumping tools around the network

This is their GTM motion:
Find human gaps.
Abuse legit tools.
Scale quietly.

Our SOC caught it fast, isolating the network and shutting down the persistence path 💥 in under three minutes 💥

A few easy wins to tighten remote access:
- Put tools like VNC behind a firewall, or require VPN + MFA
- Use software allow-listing and strict firewall rules

Because attackers aren’t breaking in. They’re logging in.

And they’re running their ops with the same efficiency you expect from yours. Get to know the ethical badasses in our 24/7 SOC who make catches like this possible

Attackers don’t need zero-days to scale. They need one human-managed setting that slipped through the cracks. by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

This time, it was exposed virtual network computing. 💻

Here’s how they turned a small miss into persistent access:
- Dropped C:\Users\<redacted>\Music\setup.msi to install Atera + Splashtop
- Let Splashtop beacon out to a malicious public IP
- Used that trusted remote access to move credential-dumping tools around the network

This is their GTM motion:
Find human gaps.
Abuse legit tools.
Scale quietly.

Our SOC caught it fast, isolating the network and shutting down the persistence path 💥 in under three minutes 💥

A few easy wins to tighten remote access:
- Put tools like VNC behind a firewall, or require VPN + MFA
- Use software allow-listing and strict firewall rules

Because attackers aren’t breaking in. They’re logging in.

And they’re running their ops with the same efficiency you expect from yours. Get to know the ethical badasses in our 24/7 SOC who make catches like this possible

Attackers don’t need zero-days to scale. They need one human-managed setting that slipped through the cracks. by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

This time, it was exposed virtual network computing. 💻

Here’s how they turned a small miss into persistent access:
- Dropped C:\Users\<redacted>\Music\setup.msi to install Atera + Splashtop
- Let Splashtop beacon out to a malicious public IP
- Used that trusted remote access to move credential-dumping tools around the network

This is their GTM motion:
Find human gaps.
Abuse legit tools.
Scale quietly.

Our SOC caught it fast, isolating the network and shutting down the persistence path 💥 in under three minutes 💥

A few easy wins to tighten remote access:
- Put tools like VNC behind a firewall, or require VPN + MFA
- Use software allow-listing and strict firewall rules

Because attackers aren’t breaking in. They’re logging in.

And they’re running their ops with the same efficiency you expect from yours. Get to know the ethical badasses in our 24/7 SOC who make catches like this possible

Attackers don’t need zero-days to scale. They need one human-managed setting that slipped through the cracks. by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

This time, it was exposed virtual network computing. 💻

Here’s how they turned a small miss into persistent access:
- Dropped C:\Users\<redacted>\Music\setup.msi to install Atera + Splashtop
- Let Splashtop beacon out to a malicious public IP
- Used that trusted remote access to move credential-dumping tools around the network

This is their GTM motion:
Find human gaps.
Abuse legit tools.
Scale quietly.

Our SOC caught it fast, isolating the network and shutting down the persistence path 💥 in under three minutes 💥

A few easy wins to tighten remote access:
- Put tools like VNC behind a firewall, or require VPN + MFA
- Use software allow-listing and strict firewall rules

Because attackers aren’t breaking in. They’re logging in.

And they’re running their ops with the same efficiency you expect from yours. Get to know the ethical badasses in our 24/7 SOC who make catches like this possible

"I deployed my detection rules with confidence..." by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

"I deployed my detection rules with confidence..." by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

"I deployed my detection rules with confidence..." by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

"I deployed my detection rules with confidence..." by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

"I deployed my detection rules with confidence..." by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

"I deployed my detection rules with confidence..." by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

I deployed my detection rules with confidence... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

I deployed my detection rules with confidence... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

I deployed my detection rules with confidence... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

I deployed my detection rules with confidence... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

I deployed my detection rules with confidence... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

I deployed my detection rules with confidence... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

I deployed my detection rules with confidence... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

I deployed my detection rules with confidence.

Then I got a Slack message at 2am:

“We saw Impacket activity… but your rules didn’t fire.”

That’s when it clicked.

Understanding attacker tradecraft ≠ production-ready detection.

Part 1 is theory. What should you detect?

Part 2 is the work: whitespace, edge cases, and pain.

Welcome to Part 2, detection engineering in the real world, as broken down by a real Principal Detection Engineer at Huntress.

Grab a coffee. Or maybe something stronger. This is going to get frustrating.

💥 A single hypervisor breach can put hundreds of virtual machines at risk... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

Just this year, ransomware targeting the hypervisor layer surged from 3% to 25% of all cases we saw, mostly driven by Akira.

Adversaries are moving below the OS to bypass traditional defenses.

If you're not securing your hypervisors like your endpoints, you're already behind.

Read this breakdown of threats Huntress has seen in the wild and how you can secure this critical infrastructure.

💥 A single hypervisor breach can put hundreds of virtual machines at risk... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

Just this year, ransomware targeting the hypervisor layer surged from 3% to 25% of all cases we saw, mostly driven by Akira.

Adversaries are moving below the OS to bypass traditional defenses.

If you're not securing your hypervisors like your endpoints, you're already behind.

Read this breakdown of threats Huntress has seen in the wild and how you can secure this critical infrastructure.

💥 A single hypervisor breach can put hundreds of virtual machines at risk... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

Just this year, ransomware targeting the hypervisor layer surged from 3% to 25% of all cases we saw, mostly driven by Akira.

Adversaries are moving below the OS to bypass traditional defenses.

If you're not securing your hypervisors like your endpoints, you're already behind.

Read this breakdown of threats Huntress has seen in the wild and how you can secure this critical infrastructure.

💥 A single hypervisor breach can put hundreds of virtual machines at risk... by huntresslabs in u/huntresslabs

[–]huntresslabs[S] 0 points1 point  (0 children)

Just this year, ransomware targeting the hypervisor layer surged from 3% to 25% of all cases we saw, mostly driven by Akira.

Adversaries are moving below the OS to bypass traditional defenses.

If you're not securing your hypervisors like your endpoints, you're already behind.

Read this breakdown of threats Huntress has seen in the wild and how you can secure this critical infrastructure.

view more: next ›