How Managed EDR Investigations Use Telemetry to Clarify Threats
Summary
Huntress explains how analysts use endpoint telemetry and forensic artifacts to trace attack origins, assess scope, and uncover related intrusions, with examples involving a tech-support scam, Akira ransomware, and activity linked to RedCurl TTPs.
Key points
- Analysts may investigate alerts or hunt proactively, using process behavior and endpoint artifacts such as Windows event logs, installed files, and browser history.
- In a tech-support scam case, QuickAssist activity and a rogue ScreenConnect installation were contextualized with notepad tabs and browser history; Huntress says the customer was contacted and the scam stopped.
- In a manufacturing-company incident, historical logs indicated access through a publicly accessible RDP instance on July 24, followed by Akira ransomware deployment on July 28; the host was isolated.
- A separate investigation found similar tradecraft across three Canadian organizations, with activity dating back to November 2023 and matching closely with known RedCurl TTPs.
- Huntress says endpoint data requests are logged with the analyst, requested data, and timestamp.
- The article argues that human-led investigations can establish root cause, severity, and wider impact beyond what an alert or automated suspension alone reveals.
Article Details
- Topic
- The role of telemetry-driven human investigations in managed EDR, including determining incident root cause, scope, and wider impact.
People
Threat Actors
Malware
Vendors
Products
Huntress Managed EDRFigure 1: Huntress Managed EDR includes human-led investigationsQuickAssistThis contextual signal–which is low fidelity and does not require investigations when detected in isolation–indicated that the QuickAssist RMM had executed.ScreenConnectEarlier this year, for instance, a customer was flagged for a rogue ScreenConnect remote monitoring and management (RMM) tool installation.Windows DefenderWhile trying to figure out the extent of the attack, the SOC team dug through historical Windows Defender detection events and logs from impacted endpoints.
Tools
certutilMaybe our detection rules trigger an alert for a living-off-the-land binary (LOLBin) after certutil downloads a file on a company’s machine.pcalua.exeFurther digging into the incident showed several other techniques used by the threat actor, including the use of a LOLBin (Windows Program Compatibility Assistant, or pcalua.exe) to execute malware and commands.