Huntress: App Allowlisting and Endpoint Zero Trust Aren’t Enough Alone
Summary
Huntress argues that application allowlisting and endpoint zero-trust controls cannot stop every attack, citing abuse of trusted tools and activity that does not require malware execution. It recommends pairing prevention with detection and response.
Key points
- Allowlisting focuses on application execution, but attackers can abuse approved software and built-in tools or steal data without running malware.
- In one Huntress SOC case, a socially engineered user’s system was targeted with PowerShell to stage payloads and download a malicious MSI; Huntress says it isolated the host.
- In another case, a malicious executable disguised as a common Windows process was actually a rogue ScreenConnect instance used for remote access; Huntress says it isolated the host.
- Huntress reports that 17.3% of remote access methods it observed involved RMM abuse and 6.8% of observed defense-evasion techniques involved bypassing security tools.
- The article cites Coveware’s finding that 41% of data-exfiltration-only victims pay ransoms, including cases without encryption.
- Huntress recommends combining preventive controls with ongoing monitoring, threat detection, and response.
Article Details
- Topic
- Limitations of application allowlisting and zero-trust endpoint prevention, and the need for layered detection and response.
MITRE ATT&CK
T1036 · MasqueradingA malicious executable was named after a common Windows process to trick the victim.T1059.001 · PowerShellPowerShell was used to stage payloads and download a malicious MSI.T1105 · Ingress Tool TransferA threat actor used a URL shortener service to download a malicious MSI file.T1204.002 · Malicious FileA user was socially engineered into downloading a malicious executable.T1219 · Remote Access ToolsA rogue ScreenConnect instance was used to facilitate malicious remote access to a victim host.
Vendors
Products
Tools
mshta.exeIt’s common for attackers to exploit built-in administrative tools like PowerShell, Windows Management Instrumentation (WMI), rundll32.exe, and mshta.exe because these are often allowed by default.PowerShellA run-in with a PowerShell downloaderRundll32It’s common for attackers to exploit built-in administrative tools like PowerShell, Windows Management Instrumentation (WMI), rundll32.exe, and mshta.exe because these are often allowed by default.Windows Management InstrumentationIt’s common for attackers to exploit built-in administrative tools like PowerShell, Windows Management Instrumentation (WMI), rundll32.exe, and mshta.exe because these are often allowed by default.