“host was isolated within minutes of the first execution to prevent further activity from occurring. the threat actor returned days later and created a service titled webrootcheck with a “ service file name ” ( command for the service ) of cmd. exe / c c : \ temp \ 1. bat. they th…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
58%
“' advanced ' intrusion targeting a marketing research company | huntress in early 2025, huntress security operations center ( soc ) analysts responded to an intrusion involving a critical market research company conducting business throughout the fortune 50 and governments worldw…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1087.003Email Account
45%
“##lookup to enumerate mail servers : the following detection rules are not high - fidelity at scale, but may be used either separately or collectively to identify threat actor activity as part of a routine threat hunting cadence involving analytical methods such as clustering or …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1556.002Password Filter DLL
37%
“of its execution. this registry manipulation is a common tactic used by threat actors to more easily dump hashed user passwords from memory. reg add " hklm \ system \ currentcontrolset \ control \ lsa " / v disablerestrictedadmin / t reg _ dword / d 00000000 / f the following com…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
An intrusion at a market research company used living-off-the-land techniques, but Huntress detected and mitigated the threat, uncovering tactics like service creation and registry manipulation. Learn more and get detection guidance and mitigation strategies.