Huntress Adds Datacenter Infrastructure to Identity Attack Detection
Summary
Huntress describes a detection method that evaluates datacenter-originated identity logins using Autonomous System context and activity baselines. The company says it reduced millions of events to hundreds of daily investigations and helped expose missed initial access.
Key points
- Huntress observed confirmed post-exploitation activity on protected identities without corresponding initial-access alerts, prompting an investigation into detection gaps.
- The article distinguishes geographic IP location, VPN or proxy use, and datacenter infrastructure as separate factors in assessing identity logins.
- Huntress says VPN- or proxy-related incidents appeared at roughly twice the rate of geographically relevant incidents in its telemetry.
- A simple detector based on datacenter and non-datacenter events in the same session produced over 1,000 mostly low-value alerts per day.
- The resulting approach groups datacenter logins by Autonomous System, compares activity against identity baselines, and flags providers assessed as having higher abuse potential.
- Huntress says the system launched in August 2025 and reduced more than 10 million authentication events to a few hundred events per day for review.
- The company reports over 3,400 events flagged for investigation, with about 3.2% rejected, and fewer cases where initial access was missed before post-exploitation activity was detected.
Article Details
- Defense Focus
- Close identity-detection gaps for initial access by evaluating datacenter-origin authentication separately from geographic location and VPN/proxy use, using autonomous-system (AS) context and identity-specific baselines.
- Detection Methods
- Correlate co-occurring alerts for the same identity within the same session and timeframe across different attack-chain stages; use missing expected alerts to identify detection gaps.
- Classify authentication IPs by geography, VPN/proxy/TOR attributes, datacenter infrastructure, and associated AS organization.
- For datacenter IPs without another technology attribute, compare authentication events with the identity's baseline of prior datacenter activity and prioritize AS organizations assessed as having higher abuse potential.
- Treat datacenter-origin logins as investigation candidates rather than automatically malicious; the article reports that a broad session-based datacenter token-theft hypothesis generated mostly low-value alerts.
- Data Sources
- Successful identity authentication and login telemetry, including source IP addresses
- Identity detection alerts and their session/timeframe relationships
- IP-address attribute and infrastructure tags from Spur, including VPN, proxy, TOR, and datacenter labels
- Autonomous System registration and organization data
- Per-identity historical datacenter authentication activity
- Platforms
- Huntress Managed ITDR
- Defensive Actions
- Do not rely on geolocation or impossible-travel analysis alone for authentication assessment; account for VPN/proxy use and underlying datacenter infrastructure.
- Investigate datacenter-IP authentications with no VPN or proxy attribute using AS organization, abuse potential, and the identity's historical baseline.
- Review cross-stage alert co-occurrence and investigate post-exploitation alerts that lack a corresponding initial-access alert.
- Tune detection around the datacenter authentication population to reduce false positives rather than alerting on every datacenter-origin event.
Vendors
HuntressI routinely analyze the Huntress Managed Identity Threat Detection and Response (ITDR) product data as part of my daily duties as a product researcher. I’m responsible for the innovation and efficacy of ITDR, and it’sSpurOur threat intel provider, Spur, tags and labels IP addresses based on their attributes. Their data is our primary mechanism for determining if an IP address is using a proxy, VPN, TOR exit node, or another technology.