Huntress Adds Host Isolation to Contain Malware on Windows Hosts
Summary
Huntress introduced managed and self-managed host isolation, blocking most inbound and outbound connections on infected Windows hosts. Isolation tasks are processed within seconds when a host is online, and connectivity is restored after the incident is resolved.
Key points
- Huntress-managed isolation can be triggered by a SOC incident report for malware considered likely to spread, such as Emotet or Trickbot.
- Administrators can also isolate hosts manually through the Huntress portal, including when another security product finds a threat.
- The isolation feature uses Windows Filtering Platform to block inbound and outbound network connections, while allowing traffic needed for Huntress and essential services.
- The previous beta relied on Local Windows Group Policy, which could be ineffective when hosts were disconnected from a domain controller or domain-level policy overrode local policy.
- Isolation tasks are processed within seconds when the host is online; administrators can exclude organizations or individual hosts from managed isolation.
Article Details
- Event Type
- Huntress announced an improved Host Isolation feature for its security platform.
- Impact
- The feature can block inbound and outbound network activity on an infected host, helping limit malware spread while remediation is planned. Huntress-managed isolation is triggered after the SOC identifies an isolation-worthy incident; self-managed isolation can also be initiated by an account user. The updated approach uses the Windows Filtering Platform, and an online host processes an isolation task within seconds.
Malware
Emotetincident has occurred, usually defined as the infection of malware that is known to quickly spread (e.g., Emotet, Trickbot, etc.). If an incident meets this criterion (and the account has enabled ‘Huntress-Managed’TrickBothas occurred, usually defined as the infection of malware that is known to quickly spread (e.g., Emotet, Trickbot, etc.). If an incident meets this criterion (and the account has enabled ‘Huntress-Managed’ Host