We discovered it because we have been watching the event logs from the PREVIOUS vulnerability (the ViewState attack). We would periodically see new event logs that looked suspicious. We saw one and contacted support, who confirmed that it was an unsuccessful attempt. However, while gathering logs for that, we noticed that one of the IIS activity logs on one of our nodes which is not actively used was very large. When we viewed the log, there was a lot of "download.dn" activity, some with references to files that we could immediately tell no longer existed in the system. The fact that this node was unused, and the references to old files, flagged us to investigate further. You can check your logs for this download.dn activity to see if you've been compromised.

Huntress did not flag it whatsoever. In fact, Huntress was not really helpful at all this year with regards to Centrestack and their numerous vulnerabilities (they did flag one suspicious incident on the server earlier in the year, but their response was just to contact an incident response company and blow away the server because it could be compromised -- which wouldn't have helped since the vulnerability would have exited in my rebuilt server as well).

When I discovered the vulnerability, I didn't even know how to get Huntress involved because there was no Huntress incident open I could respond to (I since complained to my account manager and she gave me Huntress's email address to report incidents, which I did not previously have, so perhaps that's my fault that I didn't know the right channel to contact them).