Blog Post
When Shadows Turn Hostile: How Attackers Abuse VSS (and How Huntress Catches Them)
Attackers exploit Volume Shadow Copy for credential theft and ransomware defense evasion. See how Huntress spots the difference from routine IT activity.
Blog Posts By This Author
All Categories
- Read more about When Shadows Turn Hostile: How Attackers Abuse VSS (and How Huntress Catches Them)
- Read more about The Real Reason You Won't Hand the Work to AIBlog Post
The Real Reason You Won't Hand the Work to AI
Before delegating work to AI, ask one question: can you check the output? A detection engineer on why verification, not trust, decides what tasks you hand over.
- Read more about The Great VM Escape: ESXi Exploitation in the WildBlog Post
The Great VM Escape: ESXi Exploitation in the Wild
An ESXi VM escape exploit appeared in the wild with simplified Chinese development paths and the characteristics of a zero-day. Huntress traced the intrusion from SonicWall VPN all the way through.
- Read more about The Commented Kill Chain: Why Old Ransomware Playbooks Never DieBlog Post
The Commented Kill Chain: Why Old Ransomware Playbooks Never Die
During a ransomware intrusion, Huntress found a script full of clear English comments walking through each step. Old playbooks don't die. Attackers just keep running them.
- Read more about Where Do You Think You're Going? How Huntress Addresses Lateral MovementBlog Post
Where Do You Think You're Going? How Huntress Addresses Lateral Movement
Once attackers are inside, lateral movement is how they deepen a compromise and make removal much harder. Here's exactly how Huntress detects and disrupts it before it spreads.
- Read more about defendnot? Defend YES! Detecting Malicious Security Product Bypass TechniquesBlog Post
defendnot? Defend YES! Detecting Malicious Security Product Bypass Techniques
A tool called 'defendnot' disables Windows Defender by registering a fake antivirus through undocumented Windows Security Center APIs. Huntress covers the technique and how to detect it.
Featured In These Upcoming Events & On-Demand Virtual Events
Read more about Herd Immunity for Microsoft 365: How We Stop Attacks at Sign-In
Livestream
Herd Immunity for Microsoft 365: How We Stop Attacks at Sign-In
The newest capability in Huntress Managed ITDR, Adversary Infrastructure, turns that one-time fire drill into continuous protection. When our SOC confirms the hosting, relay, or proxy infrastructure behind a compromise in one tenant, our detection engineers validate it against benign traffic. Huntress then deploys a blocking Conditional Access policy to every eligible, opted-in tenant. Attacks from that infrastructure fail at sign-in instead of becoming incidents. One partner’s incident becomes every partner’s protection. We call it herd immunity for identity.
