TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

Huntress Myths and Misconceptions | Huntress

2022-10-27 · Read original ↗

ATT&CK techniques detected

7 predictions
T1486Data Encrypted for Impact
97%
“##lnerabilities in rmm / it tools, you can bet that we ’ ll be right there should any future issues like the one we saw happen again. that ’ s just huntress ; we can ’ t help ourselves … living in the shadows so you don ’ t have to! # shadybynature myth # 3 : there is no automate…”
T1486Data Encrypted for Impact
93%
“kyle hanslovan, annie ballew and matt anderson have shared how huntress ’ managed av has thwarted advanced threat actors. whilst managed av is pretty good, it isn ’ t perfect. having antivirus by itself isn ’ t enough ; monitoring and detecting capabilities are essential in today…”
T1486Data Encrypted for Impact
91%
“isolate all machines in the domain, denying the adversary their goal of extortion. as part of our ransomware - related suite of tools, we deploy canary files to alert us to a malicious encryption event ( think of the analogy ' canary in a coal mine ' — same principle ). we don ’ …”
T1219Remote Access Tools
74%
“##s, alerts and reports for persistence are homegrown with no dependencies on other security products. this is also true for our ransomware canary tools. our external recon tooling reveals an organization ' s external network perimeter, highlighting external ports and services. a…”
T1486Data Encrypted for Impact
72%
“##s, alerts and reports for persistence are homegrown with no dependencies on other security products. this is also true for our ransomware canary tools. our external recon tooling reveals an organization ' s external network perimeter, highlighting external ports and services. a…”
T1679Selective Exclusion
45%
“isolate all machines in the domain, denying the adversary their goal of extortion. as part of our ransomware - related suite of tools, we deploy canary files to alert us to a malicious encryption event ( think of the analogy ' canary in a coal mine ' — same principle ). we don ’ …”
T1059.001PowerShell
39%
“huntress managed edr has your back regardless of the file form of the threat. myth # 5 : huntress just uses machine learning and ai. a real human doesn ' t send the reports! what in tarnation! huntress definitely deploys infrastructure automation to streamline detections and evid…”

Summary

We’ve been seeing some misinformation being spread around with regards to the Huntress technology stack/capabilities we possess today. We’re here to provide clarity.