Huntress’ Post

Deploying Managed EDR during an active intrusion? That’s the hard way to find out what it’s capable of. A metals manufacturer deployed the Huntress agent during an active intrusion. Here’s what our SOC uncovered 👇 ✅ PSExec was used to tweak registry & firewall settings for RDP access. ✅ Mimikatz.exe was hiding in C:\PerfLogs dumping credentials. ✅ Legit tools (TNIWINAGEN) were abused to scan the network, then a malicious Atera agent was deployed. ✅ A scheduled task ("MSTR tsk") was beaconing to a malicious IP. Unfortunately, not all endpoints had the Huntress agent installed. The ones we were protecting? Isolated fast—safe from ransomware. The rest? Not so lucky. Keep your business secure: ➡️ Threat actors exploit blind spots. Fully deploying Managed EDR across all endpoints reduces exposure and turns meaningless alerts into action ➡️ If your RMM tools aren’t in use, block them. ➡️ Always be ready for worst-case scenarios with a tested disaster recovery plan.

  • No alternative text description for this image
  • No alternative text description for this image
  • No alternative text description for this image
  • No alternative text description for this image
  • No alternative text description for this image
Nikhilesh Singh

Cybersecurity Researcher | SIEM | Threat Detection & Response | Security Automation Specialist | CEH, NDE | Building Scalable Security Systems

1w

Deploying managed EDR during an active intrusion—now that’s some serious real-time resilience. Loved the transparency and technical depth in this breakdown. These are the kinds of insights that really help aspiring defenders like me understand what it takes on the front lines.

Dustin Luedke

Empowering Businesses with ThreatSTOP's Cutting-Edge Cybersecurity

6d

If only they enforced cybersecurity policies at the network level of the OSI stack... You know—before Mimikatz got comfy in PerfLogs. That’s exactly where ThreatSTOP shines. Block threats at the DNS and IP level before they ever reach the endpoint. Clean, quiet, and way less stressful.

Like
Reply
Tom Le

Unconventional Security Thinking | Follow me. It’s cheaper than therapy and twice as amusing.

1w

Pro tip: If you need to parachute in to an active incident where you don't know which host is friend or foe, in addition to your EDR of choice, have various honeypots ready to go that you can deploy quickly. This gives you trusted signals and acts as a reliable "tripwire" (when properly configured). 96% of my security colleagues either underestimate or have not considered the utility of honeypots while under duress.

Hosea Kibet

Cyber Security Analyst🛡️💻 | SOC Analyst👮♂️🖥️ | Technical Support Engineer🧑💻🔧 | AWS☁️🔧

1w

Insightful

Dean Haycox

Defending Critical Infrastructure Aspiring SOC Analyst | Proactive Threat Mitigation & Incident Response | Threat Hunting

1w

I really learn a lot when you put these out on my journey to becoming a soc analyst

See more comments

To view or add a comment, sign in

Explore topics