A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.
Our partners at United Systems and F1 Solutions talk about their respective journeys with our Managed Microsoft Defender solution.
Upon blocking a request, GCP Org policy constraints were logging the deny logs in Principal''s project and the blocking project. An attacker could use those logs to exfiltrate any data, by making request from a Principal they own from a defender project.
Huntress is monitoring a new threat against Windows OS and Microsoft Office products (CVE-2021-40444). The MSHTML engine is vulnerable to arbitrary code execution.
We clarify the differences between the ProxyShell (August 2021) and the ProxyLogon (March 2021) exploits impacting Microsoft Exchange on-premises servers.
Attackers are scanning for vulnerable Microsoft Exchange servers and abusing the latest line of Exchange vulnerabilities that were patched in early 2021.
Huntress is aware of PrintNightmare, a critical RCE and local privilege escalation vulnerability. This serious security flaw affects many Windows servers.
Azure forces the install of an agent on Linux VMs, which contained a vulnerability that would grant root RCE if an attacker could send a web request to them. Initially, Microsoft did not update the agent automatically, and so customers had to patch manually, but a few days later they began patching some services remotely.
Windows' administrative shares feature is often overlooked by users, but not by hackers. Learn how attackers abuse administrative shares to propagate.
On-prem Microsoft Exchange Server vulnerabilities are being actively exploited in the wild. Read our blog for Huntress' most up-to-date research and IOCs.
Microsoft Defender Antivirus is among one of the leading antivirus contenders. Here’s why it’s worth taking another look at Defender AV.
Hackers getting better at their tradecraft and their skills are becoming more and more accessible to other bad actors via the Dark Web.
GuardDuty detected CloudTrail being outright disabled, but did not detect if an attacker with the necessary permissions filtered out all events from CloudTrail via PutEventSelectors, resulting in defenders having no logs to review. AWS fixed this issue by adding a GuardDuty detection that triggers if PutEventSelectors is used to disable all event types.
Explore the forensic perspective of the Microsoft Edge Chromium-based version and its features, such as msedge_proxy, edge cache location, and more.
Read more about Huntress validating the SolarWinds N-central “Dumpster Diver” Vulnerability.
Forensic artifacts, which can be found during forensic examination of a Windows endpoint.
Windows Prefetch files were introduced in Windows XP and since that time have helped digital forensics analysts and incident responders find evidence of execution.
Does AUTOEXEC.BAT still run on modern Windows? We test Windows 7/10, explore registry persistence, and revisit how attackers maintain access today.
IT Nation 2016 ended on a high note for Huntress Labs as we were named the “Best Newcomer” in the Partner Choice Awards. Now, as this year’s event quickly approaches, we are excited to continue our momentum.
Dive deep into Redosdru malware analysis, unpacking encrypted DLLs, keylogging behavior, and how Huntress defenders detect and respond.
When it comes to troubleshooting software errors, analyzing malware samples, or discovering security misconfigurations, the Sysinternals Suite can likely solve your problem. For many IT and Security professionals, this collection of Windows utilities is similar to the Swiss Army knife.
