Huntress Highlights Five Identity-Based Threat Patterns for Defenders to Watch
Summary
Huntress outlines five common threat patterns, from stolen-credential ransomware and mailbox compromise to ClickFix lures, and explains how defenders can spot them by correlating identity, device, and network signals.
Key points
- Ransomware incidents can begin with stolen credentials, followed by lateral movement and security-tool changes before encryption; Huntress describes one case with about 20 hours between initial access and encryption.
- Attackers can compromise Microsoft 365 mailboxes and create rules that hide or redirect messages without installing malware on a device.
- Threat actors may disguise remote-management software, use it to access systems, steal saved credentials, and attempt to disable antivirus protection.
- ClickFix lures trick users into pasting commands that install remote-access and credential-stealing tools; Huntress says these lures accounted for more than half of its malware-loader activity in 2025.
- Huntress recommends watching for suspicious admin-account use, unexpected mailbox rules, unfamiliar remote-access tools, and commands or programs launched after fake verification prompts.
- Correlating failed and successful logins across VPN, Windows, and remote-desktop records can help surface suspicious patterns that isolated alerts may miss.
Article Details
- Defense Focus
- Detect identity-led intrusions by correlating account, mailbox, endpoint, and network activity, and reduce identity and administrative-tool exposure.
- Detection Methods
- Correlate failed and successful sign-ins, VPN activity, Windows sign-ins, and remote desktop activity across a short time window; prioritize repeated IP addresses or workstation names across sources.
- Investigate bursts of failed logins followed by successful interactive sign-ins, especially for accounts not normally used interactively.
- Alert on unexpected admin or service-account movement between machines, particularly when followed by registry changes.
- Review new or renamed remote-management and remote-access installations, including installer names and paths that impersonate approved products.
- Detect security protections being disabled near the time new remote-access software appears.
- Monitor for new mailbox rules that move or hide messages, and unusual sign-ins to sensitive accounts from unfamiliar devices or locations.
- Look for Windows Run dialog use followed by unusual network activity, and new programs or scripts in temporary folders that promptly connect to the internet.
- Data Sources
- VPN logs
- Windows sign-in logs
- Remote desktop activity
- Active Directory events
- Mailbox sign-ins and inbox-rule changes
- Endpoint process, registry, software-installation, and security-setting telemetry
- Network activity
- Rule Types
- Cross-source correlation rules for brute-force and password-spray signals
- Time-windowed identity and endpoint activity correlation rules
- Single-source failed-login thresholds, described as insufficient on their own
- Platforms
- Microsoft 365
- Windows
- Defensive Actions
- Investigate correlated login signals as a potential intrusion rather than treating each failed login or blocked connection as an isolated alert.
- Disable and contain accounts confirmed as compromised; the article describes this response in a mailbox-compromise case.
- Compare remote-management software, vendors, installer names, and installation paths against the organization’s approved stack.
- Review and remove suspicious mailbox rules, especially rules that redirect or hide invoice- and payment-related messages.
- Harden identity controls by reviewing which accounts can authenticate from which locations and devices, and which tools are permitted to install or connect.
MITRE ATT&CK
T1078 · Valid AccountsThe ransomware scenario begins with an attacker using a working username and password to log in.T1110 · Brute ForceThe article discusses brute-force and password-spray detectors and patterns of failed logins followed by successful sign-ins.T1114.003 · Email Forwarding RuleIn the BEC scenario, the attacker creates an inbox rule that redirects messages to the mailbox's Conversation History folder.T1204.004 · Malicious Copy and PasteThe ClickFix scenario tricks a victim into copying and pasting a command that starts the attack chain.T1219 · Remote Access ToolsThe ransomware and RMM-abuse scenarios describe attackers installing or using remote-access software for access to victim machines.T1562.001 · Disable or Modify ToolsThe RMM-abuse scenario describes an attacker attempting to disable built-in antivirus protection.
Vendors
Products
Huntress SIEMsuccessful one buried in there, and alerts that nobody has time to fully chase down. For a long time, Huntress SIEM had the same problem, running multiple detectors for brute force and password spray that weren'tManaged EDRThat's why the Huntress team has treated identity as the connective tissue across our Managed EDR, Managed ITDR, and Managed SIEM work. And it's why we're investing in hardening controls that move defenses from "see theManaged ITDRThat's why the Huntress team has treated identity as the connective tissue across our Managed EDR, Managed ITDR, and Managed SIEM work. And it's why we're investing in hardening controls that move defenses from "see theManaged SIEMHuntress team has treated identity as the connective tissue across our Managed EDR, Managed ITDR, and Managed SIEM work. And it's why we're investing in hardening controls that move defenses from "see the attack as itMicrosoft 365 Apps for EnterpriseAn attacker gained access to an employee's Microsoft 365 account. The sign-in looked a little off—a device that didn't match how this person normally logged in—but not obviously alarming. Once inside, the attackerMicrosoft Windowsthey used the same everyday tools IT teams use to manage a network — remote access software, built-in Windows admin tools — to move from computer to computer, quietly turning off security protections and mapping out