Huntress Researchers Describe Their Day-to-Day Security Work
Summary
Three Huntress security researchers describe their daily work, tools and collaboration, including malware analysis, incident-response support, detector development and product testing.
Key points
- The researchers say their work ranges from developing internal tools and product features to building detectors and supporting analysts with complex malware investigations.
- They describe using virtual machines and analysis environments, including KVM, VMware Workstation, REMnux and FLARE VM.
- Tools mentioned include Sysinternals utilities, Docker and Ansible; their development work uses languages such as Python and Go.
- Researchers collaborate through Slack and Zoom, share analysis and code, and work with engineering and ThreatOps teams.
- They may help with larger incident-response efforts and use lessons from investigations to improve detection capabilities and team processes.
Article Details
- Topic
- The daily responsibilities, workflows, collaboration, and research tools of Huntress security researchers.
People
Caleb StewartHuntress security researcher who discusses his research work, development projects, and tools.Dave KleinatlandHuntress security researcher who discusses his research work, collaboration, and tools.John HammondHuntress security researcher who discusses his research work, malware analysis, and tools.
Vendors
Tools
Autorunssome of the security researcher-specific tools I’d say the Sysinternals suite stands out with tools like Autoruns, Procmon, Process Explorer and more. I also keep a good clean snapshot of both a Windows and Linux-basedFLARE VMof a virtual machine while working. I will be bouncing back and forth between a REMnux install and a FLARE VM install for malware analysis, different renditions of Windows workstations or server operating systemsKVMfor researching a new threat/vulnerability, analyzing a piece of malware or just testing software. I use KVM which is the built-in virtualization solution on Linux for all my virtualization.Process Explorertools I’d say the Sysinternals suite stands out with tools like Autoruns, Procmon, Process Explorer and more. I also keep a good clean snapshot of both a Windows and Linux-based analysis machine withProcmonsecurity researcher-specific tools I’d say the Sysinternals suite stands out with tools like Autoruns, Procmon, Process Explorer and more. I also keep a good clean snapshot of both a Windows and Linux-based analysisREMnuxI am almost always inside of a virtual machine while working. I will be bouncing back and forth between a REMnux install and a FLARE VM install for malware analysis, different renditions of Windows workstations orSysinternals SuiteAs far as some of the security researcher-specific tools I’d say the Sysinternals suite stands out with tools like Autoruns, Procmon, Process Explorer and more. I also keep a good clean snapshot of both a Windows and