Huntress Details Microsoft 365 MDR Detection Gaps and Planned Updates

Summary

Huntress says it has improved Microsoft 365 login detections and onboarding after acknowledging gaps in its MDR service, and outlines planned detection updates for account takeovers, inbox rules and suspicious applications.

Key points

Huntress describes four Managed ITDR focus areas: unwanted logins, suspicious inbox rules and forwarding, alternative access methods such as Microsoft Graph API and Azure tools, and rogue applications.
The company says location-based detections can be bypassed, including through token theft and fake-device registration; it released anonymous VPN and anomalous-location detections in early December 2023.
Huntress reports that about two-thirds of the malicious activity it sees comes from anonymizing services and almost half from VPNs.
The company says it had tuned detections too heavily to avoid false positives, causing some activity to be missed; it reports making changes and having its SOC filter additional alerts.
Huntress says onboarding improvements have brought Microsoft 365 tenant integration to under 90 seconds, with more than 90% of onboarding processes completing without issues.
Planned updates include more than a dozen location- and threat-intelligence-based detections, geo-allowlisting, user behavior fingerprints, improved inbox-rule detection and weekly reports for some credential-related alerts.

Article Details

Event Type: Product update
Impact: Huntress described detection and onboarding improvements for its Managed ITDR offering for Microsoft 365, including newly released anonymous VPN and anomalous-login detections and planned additions. Huntress reported onboarding hundreds of thousands of identities and more than 1,000 incidents, and said approximately two-thirds of the malicious activity it observes comes from anonymizing services and almost half from VPNs. The company also acknowledged that earlier detection tuning missed some activity.