Huntress Extends Managed Identity Threat Detection to Google Workspace

Summary

Huntress announced Managed ITDR for Google Workspace, which monitors suspicious logins and inbox rules. The company says its SOC stopped a stolen-credential attack involving suspicious infrastructure and alert-suppressing Gmail rules.

Key points

The service adds Google Workspace identity monitoring to Huntress Managed ITDR, alongside Microsoft 365.
At launch, it detects unusual authentication patterns, including suspicious locations and datacenter infrastructure, and malicious Gmail inbox rules.
Huntress says its SOC can revoke sessions and remove malicious rules when suspicious activity is detected.
In a company-described case, stolen credentials and suspicious infrastructure were used to access an account and create rules that hid Google security alerts.
Huntress says the investigation found password-change attempts, probes against administrative accounts, and attempts to distribute malicious calendar invites.
The company says it stopped the attack before subsequent phishing or financial fraud; the account compromise was not independently verified in the article.

Article Details

Event Type: Huntress announced the expansion of its Managed Identity Threat Detection and Response (ITDR) service to Google Workspace.
Impact: The service is intended to detect and respond to Google Workspace identity attacks, including suspicious authentication activity and malicious inbox rules. In a reported real-world incident, Huntress says its service detected suspicious infrastructure and rules suppressing security alerts; its SOC revoked the attacker's access and removed the rules before the attack escalated. The article reports further password-change attempts, probes against administrative accounts, and attempted distribution of malicious calendar invites.