Huntress Launches Early Access to Endpoint and Identity Security Posture Management
Summary
Huntress announced early access to endpoint and identity posture management services. The company illustrated their purpose with incidents involving a rogue Datto RMM deployment and an account missing MFA that was used to send internal phishing emails.
Key points
- Huntress announced Managed Endpoint Security Posture Management (ESPM) and Managed Identity Security Posture Management (ISPM) in Early Access.
- Huntress says ESPM is intended to address endpoint risks including misconfigurations, unauthorized tools, and abuse of legitimate applications.
- ISPM assesses Microsoft 365 identity settings, including Entra ID and Conditional Access, and can automatically enforce security policies when settings drift.
- In one incident described by Huntress, a phishing link led to a fake Microsoft Store page and a signed executable that deployed a rogue Datto RMM instance; Huntress says its response team removed it.
- In another incident, Huntress says an account without MFA was accessed from an unusual datacenter location and used to send internal malicious emails; the SOC disabled the identity.
- Huntress says its threat intelligence linked the second incident’s tradecraft and infrastructure to activity overlapping with North Korean cybercrime syndicates.
Article Details
- Event Type
- Huntress announced two new proactive security posture management offerings, Managed Endpoint Security Posture Management (ESPM) and Managed Identity Security Posture Management (ISPM), now in Early Access.
- Impact
- The offerings are intended to reduce endpoint and identity attack surfaces through ongoing posture assessment, security policy enforcement, and automatic correction of configuration drift. The article also describes two incidents: a phishing-delivered installer was used to deploy a rogue Datto RMM instance from a compromised domain, and an account missing MFA was compromised and used to send internal malicious emails. Huntress says its SOC remediated the rogue RMM and disabled the compromised identity.
MITRE ATT&CK
T1071 · Application Layer ProtocolThe attacker used a rogue Datto RMM instance for persistence; the article does not specify its communications protocol.T1114 · Email CollectionThe article reports mailbox manipulation and persistence among common identity threats, but does not describe the specific mailbox actions.T1566.002 · Spearphishing LinkA phishing email directed a user to a fake Microsoft Store page.
People
Vendors
Products
Datto RMMRogue Datto RMM via fake Microsoft Store updateEntra IDaccounts. Managed ISPM provides ongoing posture assessments for Microsoft 365, tapping into Entra ID and Conditional Access.Managed ESPMof the Huntress Agentic Security Platform with two new proactive offerings: Managed Endpoint Security Posture Management (ESPM) and Managed Identity Security Posture Management (ISPM), both in Early Access.Managed Identity Security Posture Management (ISPM)new proactive offerings: Managed Endpoint Security Posture Management (ESPM) and Managed Identity Security Posture Management (ISPM), both in Early Access.Microsoft 365 Apps for Enterpriseof bad defaults and over-privileged accounts. Managed ISPM provides ongoing posture assessments for Microsoft 365, tapping into Entra ID and Conditional Access.