Blog Post
When Shadows Turn Hostile: How Attackers Abuse VSS (and How Huntress Catches Them)
Attackers exploit Volume Shadow Copy for credential theft and ransomware defense evasion. See how Huntress spots the difference from routine IT activity.
Blog Posts By This Author
All Categories
- Read more about When Shadows Turn Hostile: How Attackers Abuse VSS (and How Huntress Catches Them)
- Read more about The Real Reason You Won't Hand the Work to AIBlog Post
The Real Reason You Won't Hand the Work to AI
Before delegating work to AI, ask one question: can you check the output? A detection engineer on why verification, not trust, decides what tasks you hand over.
- Read more about The Great VM Escape: ESXi Exploitation in the WildBlog Post
The Great VM Escape: ESXi Exploitation in the Wild
An ESXi VM escape exploit appeared in the wild with simplified Chinese development paths and the characteristics of a zero-day. Huntress traced the intrusion from SonicWall VPN all the way through.
- Read more about The Commented Kill Chain: Why Old Ransomware Playbooks Never DieBlog Post
The Commented Kill Chain: Why Old Ransomware Playbooks Never Die
During a ransomware intrusion, Huntress found a script full of clear English comments walking through each step. Old playbooks don't die. Attackers just keep running them.
- Read more about Where Do You Think You're Going? How Huntress Addresses Lateral MovementBlog Post
Where Do You Think You're Going? How Huntress Addresses Lateral Movement
Once attackers are inside, lateral movement is how they deepen a compromise and make removal much harder. Here's exactly how Huntress detects and disrupts it before it spreads.
- Read more about defendnot? Defend YES! Detecting Malicious Security Product Bypass TechniquesBlog Post
defendnot? Defend YES! Detecting Malicious Security Product Bypass Techniques
A tool called 'defendnot' disables Windows Defender by registering a fake antivirus through undocumented Windows Security Center APIs. Huntress covers the technique and how to detect it.
