Herd Immunity for Microsoft 365: How We Stop Attacks at Sign-In

In March, our SOC watched a phishing-as-a-service operation turn Railway, a developer cloud platform with a spotless IP reputation, into a token-harvesting engine that hit 344 organizations. We responded by pushing an emergency Conditional Access block to every eligible tenant we protect. It worked: 305 attack attempts were stopped at the door, and no legitimate logins were affected. Then the attackers moved to new infrastructure, as they always do.

Adversary Infrastructure was built to solve this problem. 

The newest capability in Huntress Managed ITDR, Adversary Infrastructure, turns that one-time fire drill into continuous protection. When our SOC confirms the hosting, relay, or proxy infrastructure behind a compromise in one tenant, our detection engineers validate it against benign traffic. Huntress then deploys a blocking Conditional Access policy to every eligible, opted-in tenant. Attacks from that infrastructure fail at sign-in instead of becoming incidents. One partner’s incident becomes every partner’s protection. We call it herd immunity for identity.

Join Rich Mozeleski, Staff Product Manager, Matt Anderson, Principal Detection Engineer & Threat Hunting Analyst, and Erin Meyers, Principal Product Marketing Manager, for the story behind this capability, the campaigns that helped shape it, and how we’re transforming protection for one into protection for all.