cyber.hendryadrian.com
Security News · huntress.com

Huntress Adds Microsoft 365 Rules and Escalations to Flag Suspicious Logins

· Original article ↗

Summary

Huntress introduced Unwanted Access, a Microsoft 365 identity capability that analyzes login sessions and lets customers define expected or unauthorized locations and VPNs. Its SOC can send escalations when login activity needs clarification.

Key points

  • The capability analyzes Microsoft 365 events and organizes them into sessions to help identify possible session hijacking and credential theft.
  • Customers can set expected or unauthorized location and VPN rules at the account, organization, or identity level.
  • Rules provide context to Huntress’s SOC; expected locations or VPNs do not stop it from reviewing login events for suspicious activity.
  • The SOC can send an escalation when it needs more information about a login, such as activity from a location not covered by existing rules.
  • Escalations are flags for investigation, not active incidents, and are delivered by email and PSA and shown in the Huntress portal.

Article Details

Event Type
Huntress introduced Unwanted Access, a new capability within its Managed Identity Threat Detection and Response offering.
Impact
The capability analyzes Microsoft 365 login events grouped into sessions and uses configurable expected or unauthorized location and VPN rules to provide context for SOC investigations. It also sends escalations when login activity from an unknown location or VPN needs further review. The article describes the capability as intended to help detect and mitigate session hijacking and credential theft before compromises escalate.

Vendors

HuntressAt Huntress, we’ve seen how session hijacking and credential theft are critical vectors that hackers exploit to gain unauthorized access to your business-critical assets.

Products

Managed Identity Threat Detection and ResponseThat’s why the Huntress Managed Identity Threat Detection and Response (ITDR) team has introduced Unwanted Access, a new capability focused on wrecking hackers by shutting down the primary ways they take over accounts:Microsoft 365 Apps for EnterpriseWe start by analyzing Microsoft 365 events, organizing them into sessions, and then incorporating partner and customer feedback about expected and unauthorized VPNs and locations via Unwanted Access configuration rules.Unwanted AccessUnwanted Access: Protecting Against the Growing Threat of Session Hijacking and Credential Theft

Related Articles