How Huntress Balances EDR Feature Parity Across Windows, macOS, and Linux
Summary
Huntress explains how its EDR collects telemetry across Windows, macOS, and Linux, and why it prioritizes platform-specific security value over identical features. The company says its ransomware canaries generated over 260 alerts tied to confirmed ransomware behavior.
Key points
- Huntress describes a layered telemetry approach intended to focus on useful activity while limiting agent resource use.
- On Windows, its EDR combines real-time sources such as kernel callbacks and event logs with scheduled or on-demand surveys.
- On macOS, the EDR uses Apple’s Endpoint Security API; deployment can require system-extension approval and permissions, while process data can include code-signing details.
- On Linux, Huntress says its agent primarily uses eBPF for process telemetry and file activity to help identify persistence.
- Huntress says its ransomware canaries generated more than 260 alerts associated with confirmed ransomware behavior in 2025.
- The company says ransomware targeting macOS and Linux hosts remains less prevalent than on Windows, while noting emerging Linux ransomware and increased attacks against Linux-like ESXi hosts.
Article Details
- Topic
- Cross-platform feature parity and telemetry collection in Huntress Managed EDR for Windows, macOS, and Linux, including platform-specific approaches to ransomware detection.
People
Malware
AkiraA good example of this is the Akira variants.EvilQuestEvilQuest was one of the primary ransomware strains known to target macOS, but the numbers have been completely inflated.LockBitBack in 2023, Objective-See released a blog describing an emergent Lockbit ransomware variant targeting macOS; however, according to Patrick Wardle at Objective-See, “It worth nothing [sic] that this sample is far from
Vendors
AppleOn macOS, to access low-level process behavior, using Apple’s Endpoint Security API is the only option, especially the Apple-recommended approach.HuntressAs a technology provider offering multiple products across various operating systems (OS) and platforms, Huntress continually seeks ways to enhance the customer experience, enabling seamless experiences.
Products
AppArmorMany common Linux distributions come with security features, like SELinux and AppArmor, out of the box.Managed EDRManaged EDR for Windows has been around for almost five years, the EDR for macOS for a year, and EDR for Linux for only a few months.Ransomware CanariesA good example of this is our Ransomware Canaries capability.SELinuxMany common Linux distributions come with security features, like SELinux and AppArmor, out of the box.VirusTotalIf you were to look at VirusTotal, it would appear that there are new strains of EvilQuest (also called ThiefQuest) almost daily.