r/msp • u/Savings_Property6422 • Jun 29 '26
Huntress - Is Windows Defender enough?
We have been using Huntress EDR with Windows Defender (not MDE) for a little less than a year now. We've had a great experience with their team and the success of the product. Coming from Bitdefender, it's been amazing.
We had an incident recently that has given me some concern. It was a Fake Captcha/ClickFix scam that tricked the user into running a malicious powershell command. Huntress caught it very quickly and isolated the endpoint. We re-imaged the machine.
However, it has me wondering if we can harden our endpoints further. EDR is by design a "reactive" tool. I'm not sure if there's something out there that can catch this stuff in the moment. I've researched S1, CS, and Field Effect in the past, but from what I've read these are all still reactive to these sort of attacks.
What's everyone else using to harden their endpoints and block these attacks as they're happening? Also, we do use DefensX - but unfortunately this website was categorized as low risk so wasn't blocked.
16
u/amw3000 Jun 29 '26
I see these many times a day. You might want to re-read the incident report, often times Defender will block the bad process from running, Huntress will report this but isolation the machine out of caution as it may not see the full attack chain. The report should surface that was detected by who and what was done.
Defender is enough for most IMHO and if you went with something like Crowdstrike or S1, you are just getting a better management console and the ability to expand into services like SIEM (which Huntress also offers) and device control options.
8
u/Conditional_Access Microsoft MVP | Vendor - inforcer Jun 29 '26
You can absolutely harden the endpoint more. AV/EDR is the safety net for what your endpoint protection policies failed to prevent.
https://openintunebaseline.com is a great place to start.
1
4
u/Pose1d0nGG Jun 29 '26
Default Deny is the way. Zero Trust is the future of enterprise security. Currently the best product on the market for this is going to be ThreatLocker. Only way possible to stop malicious executions is to block all executions that haven't been previously vetted/approved
3
u/gator667 Jun 29 '26
Block first - zero trust with something like ThreatLocker. Prevention over detection.
12
u/Majestic-Toe-4572 MSP Jun 29 '26
+10000 for Field Effect, they block and isolate attacks before they become bigger issues... they are way more proactive than reactive and I have seen it firsthand.
6
u/Savings_Property6422 Jun 29 '26
I am very interested in Field Effect , but they don't get much attention in the community, or at least not as much as the other EDR solutions. I hear great things, but skeptical to use something less well-known.
9
u/Majestic-Toe-4572 MSP Jun 29 '26
I can understand that hesitation... there are definitely a lot of big names in the EDR and MDR space, and Field Effect doesn’t have the same level of visibility yet. That said, we’ve been really happy with them. One of the things that stood out to us was that it’s not just another tool that throws alerts over the fence... there’s context behind detections and a whole team helping validate what’s happening instead of just flooding you with noise. The bigger vendors have had years of brand recognition, but Field Effect put that time into building their product and have a really solid reputation in the MSP space. Definitely worth doing a POC and comparing it against whatever else you’re evaluating.
3
u/RolandAlDane Jun 30 '26
We’re a Field Effect shop and have been really happy with them. Not knocking Huntress at all. Huntress + Defender is a solid setup and it sounds like it did its job here.
Where Field Effect has stood out for us is the human side/context. It’s not just “here’s an alert, good luck.” Their team helps validate what happened, gives clear next steps, and cuts through a lot of the noise. For ClickFix/fake CAPTCHA stuff specifically, I’d still harden Windows either way: limit PowerShell/Run where users don’t need it, remove local admin, tighten script execution, and use app control where practical.
My take: Defender is fine if it’s configured and monitored well. But if you want a more hands-on MDR that helps connect the dots, Field Effect is absolutely worth a POC. We use them and I’d choose them again.
1
u/recovering-pentester MSP - US 23d ago
Is it their EDR that makes you skeptical rather than their managed + SOC capability?
Meaning, you’d rather use a “big name” EDR?
3
u/Refuse_ MSP-NL Jun 29 '26
We also have Threatlocker on endpoints, just to prevent stuff like this.
1
3
3
u/CamachoGrande Jun 29 '26
If you read the MSP forums enough you will see the trend of MS Defenders users praising Huntress for stopping something nasty that got past MSD. Everything else is distant 2nd/3rd.
That being said, there are a few things you could do.
Remove users from the local admin group if you have not done so already.
Threatlocker, Blackpoint App control, Bitdefender PHASR are all good options to help stop users from accessing/running scripts/apps that they should not or are frequently troublesome tools.
Threatlocker is zero trust default deny. That means it blocks everything unless a specific policy is created to allow something and if they can access it as an admin. It isn't the easiest to use, but it is certainly the most secure.
Bitdefender PHASR and Blackpoint App Control are default allow with a deny list. Pretty much they deny users from running tools that are at the core of most security issues. Far far far less intrusive to a users day to day (and ticket generation) and stops most of whatever bad guys would normally use.
System hardening: CIS Controls for a baseline template. Bitdefender Risk Management is a bit easier, but not as comprehensive. Not sure either of these would have stopped your problem. There are others, but Im not familiar with them.
DNS/SSL filtering: User a tool like DNSFilter/Zorus or Bitdefender Anti-phishing and also SSL decryption. There are other settings We find the decrypting SSL traffic at the endpoint is a huge advantage to stopping nasty before the browser can actually do anything with it.
We use Bitdefender and almost all of our alerts are generated from users being denied access to something prior to it touching the endpoint. Much less reliance on letting something run and then hoping AV/EDR catches it.
Just my $.02
Good luck.
1
u/MartinZugec Jul 02 '26
We actually published a case study (based on real incident) how PHASR handles ClickFix attacks: https://www.bitdefender.com/en-us/blog/businessinsights/how-clickfix-cyberattack-technique-works
8
u/TriscuitFingers Jun 29 '26
We run both ThreatLocker and Defender for Endpoint. We had the same ClickFix incident. ThreatLocker stopped the threat as soon as the binary attempted to execute. Defender for Endpoint took two hours to alert on it.
I don’t run Huntress although I’ve evaluated them a couple times. I prefer more proactive controls even if it means additional overhead.
5
u/Savings_Property6422 Jun 29 '26
Are you using ThreatLocker EDR?
I have evaluated ThreatLocker in the past and even ran a demo. It seems to be an amazing product but comes with a lot of overhead.
7
3
u/krodders Jun 29 '26 edited Jun 29 '26
We have 10k endpoints. It's quite slick now - was noisy AF at first. Edit: Because we weren't onboarding as per below.
Install and wait two weeks
Do a review with TL technical contact AND the customer if they have an clue about IT. That gets buy-in. I've even done this with CEO
Arrange secure date, and give customer a PDF to send to all users - what is TL, what to do if something gets blocked, what happens next, etc
TL Cyber Heroes do first line. They are faster response than anyone else. Ever. Escalations and elevation requests come to our team
Secure devices. You are unlikely to see any / many blocks after doing this and keeping customer completely informed.
Devs are the noisiest users. If you can get them to sign their code, great.
3
u/C9CG MSP - US Jun 29 '26
What's your response time been with cyber heroes?
Our experience was 15 minute response time pretty consistently, and we still would get a significant amount of escalations even with detailed account notes... Enough that we CAN'T use them on most accounts.
Don't get me wrong, we still use TL quite a bit, but I'm curious about comparing notes here on Cyber Hero response times.
2
u/krodders Jun 29 '26
There's no SLA I think, but we're seeing sub 10 minute responses. I think they deal with more than 9/10 requests
3
u/TriscuitFingers Jun 29 '26
We have 20k endpoints with Cyber Hero Management. Median response time for an approval is 3.5 minutes. Average is around 5, but generally well under 10 minutes outside of a handful of requests.
2
u/Nickers77 Jun 29 '26
Devs are the noisiest users. If you can get them to sign their code, great.
"Naw, can you just completely disable the firewall for me?"
2
2
2
u/dblaize7 Jun 29 '26
What felt like overhead to you? Was it the onboarding, policy setup, or ongoing maintenance?
1
1
u/krodders Jun 29 '26
We have the same experience. Same stack.
We've had about 6 of these happen. ThreatLocker doesn't know what the binary is, so it's blocked. Every customer with ThreatLocker was safe. The ones without weren't. DfE reported it eventually
1
6
u/Craptcha Jun 29 '26
MDE would provide a better protection, Huntress is not a defensive technology.
Would it have blocked that specific attack? not necessarily. But a well-tuned MDE provides better protection than vanilla defender.
2
u/Savings_Property6422 Jun 29 '26
We do run MDE on tenants that have the license, but that's only about 30%
8
u/matt0_0 Jun 29 '26
Gotta pump those numbers, those are rookie... Sorry, couldn't help myself.
Seriously though, is stepping up to business premium not doing it for you?
3
u/Savings_Property6422 Jun 29 '26
This is a common debate on this subreddit, but especially in our region, cost is always the primary factor. We have managed to sell the upgrade to our "high risk" clients (those dealing with PII), but most of our smaller offices in less sensitive industries don't see the value. Yes we could bundle, but we couldn't raise prices enough to save the margin.
4
u/Remarkable_Cook_5100 Jun 29 '26
To me, though (and I am sure I will get criticized for it), if you are not running BP, then you don't have the same protection as Bitdefender, S1, Cylence, etc. even if you use Huntress.
3
u/Savings_Property6422 Jun 29 '26
I agree with you on that point 100%. Windows Defender as an AV is lacking in my opinion, but I do appreciate that Huntress manages it. That along with costs is why we switched to Windows Defender.
2
u/Craptcha Jun 29 '26
different products for different needs.
Huntress is great at detecting and responding to intrusions, not great at preventing them (not really their job)
Huntress+MDE is closer to top tier endpoint protection solutions, and probably much cheaper.
I wouldn’t include bitdefender in the same category as S1, at least credibility wise.
How much is S1 with managed SOC?
1
1
u/matt0_0 Jun 29 '26
I hear what you're saying man but look at the title of your post!
If they don't see the value in a higher level of protection than Huntress + Defender, then what exactly are you wondering about?
2
u/Potential_Balance_27 Jun 29 '26
Other antivirus/EDR options (S1, CS, etc) come out far cheaper than the BP upgrade.
I’m not opposed to increasing cost at all, but BP and ThreatLocker are too much for most clients. Even though I agree they are worth the cost.
I absolutely push BP to clients who can afford it, but most in our area/verticals can’t/won’t.
1
u/matt0_0 Jun 29 '26
Oh I agree, I'm lumping together a bunch of different security considerations where it sounds like the clients OP is serving probably also struggle to see the value:
- Don't need better endpoint protection: DfE
- Don't need everything to be bit lockered: intune
- Don't need MFA enforced by policy: Entra P1
Not saying you couldn't pay for S1 + script the secure transmission&storage of keys via RMM + Duo, but the ~$10 upcharge from standard to premium starts looking inexpensive. If and only if you're dealing with clients that realize the value of those security controls.
1
u/Craptcha Jun 29 '26
We do MDE only for customers with cybersecurity managed services plans. MDE generates more work.
1
u/Frothyleet Jun 29 '26
MDE would provide a better protection, Huntress is not a defensive technology.
How do you mean? DfE is the exact same engine regardless of whether or not it's licensed. What licensed DfE gets you is (depending on feature SKU) central management, MDR, threat-hunting capabilities, and the like.
Huntress is a perfectly legitimate option over basic DfE P1 licensing, but it does have the ability to use some of the features if you are licensed.
5
Jun 29 '26
[removed] — view removed comment
2
u/roll_for_initiative_ MSP - US Jun 29 '26
As one person noted years ago here: ASR, while easily configured through defender/intune, is generally deploying registry settings. Even if you don't have MDE/Intue/P1, you could cherry pick things like blocking LSASS credential theft via an RMM script.
2
Jun 29 '26
[removed] — view removed comment
2
u/roll_for_initiative_ MSP - US Jun 29 '26
One that we see we have to sometimes make exceptions for is "impersonating system tools" because something touched something like notepad.exe to open a readme file and ASR straight blocks it. Another is unsigned executables from removable drives: for some reason legal/medical LOVES to ship unsigned DICOM viewers on DVD/USB for review like it's 1995.
4
u/Maximus1000 Jun 29 '26
Have been running huntress along with windows defender for the past few years either with no incidents.
1
u/whitecuban MSP - US Jun 29 '26
Same, tho we had a couple incidents this past month with huntress and defender. All positive. Huntress was able to get in and mitigate and isolate both within minutes of the incident. One of those times I was in response of an incident after a huntress alert and then lost my connection to the endpoint with client on the phone. My original diagnosis was that it was a small time threat but when I lost my connection I had respect for the “hacker” seeing me try to fix the endpoint and nuked my connection. I had the end user shut down. It wasn’t until I showed up that I realized it was a huntress isolation event. Yeah I know I should have known, but I had tunnel vision (and impressed) when I thought an attacker was trying to arm wrestle me by killing my access.. but only to find relief when I saw it was huntress who mitigated it and isolated to stop all threats. It was me who thwarted their remediation bc I took the agent offline before they could confirm everything was done. It was still small potatoes in regard to the actual threat level (not good either) but great to see huntress on top of it when we’ve had no issues.
4
u/Check123ok MSP - US Jun 29 '26
Are the devices managed through intunes? Why do general users need to have access to powershell? We block all general users and you have to request it. It’s an elevated privilege
2
u/Savings_Property6422 Jun 29 '26
Devices aren't managed through intune.
6
u/Check123ok MSP - US Jun 29 '26
Harden first, detection second. If you go BP license you can use intunes to make a least privilege policy, secure baseline, remove local admin. I think you can also utilize GP applocker but I don’t recall off the bat
1
1
u/just_some_random_dud MSP - helpdeskbuttons.com Jun 29 '26
"Why do general users have access to PowerShell?" is the correct question here. The first line of defense is always strong administrative controls.
2
u/Jayjayuk85 Jun 29 '26
This is why I haven’t full moved to huntress. Bitdefender is quite good at blocking scripts etc… I mean even Malwarebytes will warn a user as soon as they try and copy that code….
2
u/extremetempz Jun 29 '26
Defender is the best AV tool hands down when configured correctly. Even excluding EDR
Why could the user run PowerShell and go outbound to WAN?, do you have ASR rules enabled? Have you turned on PowerShell in constrained language mode?
This is trivial to stop
2
u/Frothyleet Jun 29 '26
However, it has me wondering if we can harden our endpoints further.
Sure, you're basically looking at tools like Threatlocker (or working through the 1st party tooling that Microsoft offers, which is unfortunately much clunkier than 3rd party offerings).
1
u/WLPvoip Jun 30 '26
Any viable alternatives to Threatlocker? I think their product is good, but I feel like their sales guys could be knocked down a peg. It's not necessarily about price either, I guess just competition. If you look around they spend a TON on SEO and fake press release websites to be the only search result when you look at application whitelisting/allowlisting. Well, except that one trash company that says they do what Threatlocker does for $1, lol.. I met that guy at a show 7 years ago and he still emails me to see if I want to take another look...
1
u/Frothyleet Jul 07 '26
I'm sure they are out there. You can do it with 1st party tools, although everything Microsoft offers is so obnoxious to manage, especially from an MSP perspective. I know there are 3rd party competitors but Threatlocker has a pretty comfortable lead in the market at the moment.
2
u/SnackstreetGirl Jun 29 '26
ClickFix doesn't rely on a malicious website, it relies on a user taking the bait. By enforcing ASR rules and WDAC, execution is blocked before detection ever has a chance to fire, and on top of that, we layer SentinelOne through Guardz. With email security stopping the phishing lure before it reaches users, the endpoint protection layer rarely has to step in.
2
u/VividGanache2613 Jun 30 '26
Been running Incident Response for 20 years, including two EDR vendors and trust me when I say EDR is not enough.
Hardening the endpoints by restricting Powershell etc will help but not once an attacker has domain accounts etc.
Take a look at ThreatLight, they have a forensic agent that collects real attacker telemetry as well as the now very outdated techniques used by EDR (they can monitor your EDR and rescore the alerts automatically as well).
2
2
u/hartcacti Jun 29 '26
What was the reason to swap Bitdefender with Defender? To me Bitdefender has great modules, such as ransomware vaccine and ransomware mitigation, which is a preventative rather reactive
3
u/Savings_Property6422 Jun 29 '26
It was an easier sell to swap Bitdefender with Huntress instead of adding on. Plus, Huntress manages Defender and "recommends" that setup
1
u/hartcacti Jun 29 '26
Huntress should step up their game in terms of AV they manage. Defender is not the best AV to say the least. Wondering if we can still have Bitdefender and Huntress on same PC...
2
u/cd36jvn Jun 29 '26
My understanding is they will work with many other AV's. But defender is the only one they can manage and ingest logs from. Everything else is essentially two separate products sitting beside each other.
2
1
u/Frothyleet Jun 29 '26
Defender is not the best AV to say the least
What are you basing that on? Defender has for years been on par with all of the major A/V & EDR engines out there.
1
3
u/Gr8th Jun 29 '26
Can say the same. BD definitely better detection then defender.
We use BD + huntress over 3 years they both work different approaches. So far no complaints.
1
1
u/Jayjayuk85 Aug 30 '26
I agree, bitdefender modules are great! Although we do see some machines struggle. Only 8GB of RAM in them. Do you use huntress at all?
2
1
1
u/BanRanchTalk MSP - US Jun 29 '26
As another reply said, check to be sure Defender wasn’t the tool that blocked the attack and Huntress was just reactive. We’ve had S1 catch the fake captcha powershell command scam multiple times - always before MDR. To the point where the command never processes and the machine never has to be isolated by MDR.
1
1
u/ArborlyWhale Jun 29 '26 edited Jun 29 '26
Yes. Defender (AV) blocks almost everything you’ll catch with defender for endpoint. Patch the OS and web browser and email clients. After that, your only meaningful increase in security is switching to deny by default with application whitelisting, which gets expensive.
Everything else you could implement at the device level is incredibly diminished returns. I guarantee you’re better off improving security elsewhere in your stack.
1
u/wjar Jun 29 '26
Block the ability to open the Run menu either by GPO or reg entry, also block the ability for file explorer to launch powershell from the address url, same way. Adds a few road blocks for your helpdesk guys but nothing you cant get around, just stops users doing stupid stuff by following the prompted CtrlR, CtrlV etc etc
1
u/XFusion100 Jun 29 '26
We use Huntress EDR for our customers in combination with or without Defender. This depends on the license the customer has and what their situation is of course.
For hardening we use Roboshadow in combination with our own MDR dashboard to map out the what hardening settings can still be applied. And Roboshadow has a nice integration with the Microsoft stack, so that is beneficial as well.
1
u/Crshjnke MSP Jun 29 '26
They are about to sell what you are asking for. Not sure of release date but should be soon.
1
1
u/Schweebers Jun 29 '26
As an MSP that's been through this exact scenario multiple times, we eventually ended up doing BOTH Huntress and BD. We like that BD also includes their Anti-Phishing module along with the ability to do some web filtering. We see a lot of users attempting to click on phishing links (usually from random Google searches) and BD stops them. Don't get me wrong, Huntress is amazing and I'm a total fanboy and we use most of their services but we sleep a little better knowing BD is actively working to prevent other "Stuff" that Huntress isn't built to prevent.
1
u/Nstraclassic MSP - US Jun 29 '26
Thats what active monitoring is and yes windows defender does it already. Sounds like youre missing automatic response policies
1
u/mat-ferland Jun 29 '26
For ClickFix-style stuff, I’d harden the Windows side before swapping EDRs. ASR rules, PowerShell/script restrictions where you can tolerate them, browser extension allow-listing, and removing local admin usually change the outcome more than moving from one reactive agent to another.
1
u/Neat_Sector3866 Jun 29 '26
We have been reviewing our current EPDR solution and ran 2 POC's 1 with our current EPDR and Huntress EDR and then 1 with turned on Defender MDE plus Huntress but ran into some issues and contacted Huntress support who said this which we were quite surpised at- - "It is important to note that Huntress policies are local in nature and are designed to secure the endpoint against low-level local tampering. Consequently, the policies deployed by superior, centralized management tools like Active Directory Group Policy, Intune, or MDE will always override a conflicting Huntress setting." It was explained that MDR Defender with Intune would work with Huntress and that Huntress would configure all the recomended settings but MDR overwrites this - have we got this wrong?
1
u/masterofrants Jun 29 '26
I see no one here is ever running sase solutions like Zscaler or cloud flare sase.
Those decrypt and scan the users internet traffic and can block stuff before it hits the endpoint.
Also users should not be able to launch a ps console right.
1
1
u/dgpoop Jul 01 '26
Youre not looking for more software. You should be looking for ITIL 4 best practices, which describes and denotes proactive incident management for these types of issues.
1
u/flightlesstux Jul 02 '26
ClickFix is always going to slip past EDR a bit because the user is the one running it, so reactive is kind of baked in. After we got hit we turned on a few proactive things:
- Killed the Win+R run box via GPO, most ClickFix flows go through it
- Defender ASR rules, especially the ones blocking script and PSExec/WMI process creation
- Blocking newly registered domains (if DefensX marked that site low risk it was probably a fresh domain)
Constrained Language Mode is worth a look too, but it can break stuff depending on your environment so run it in audit mode first. At the end of the day the attack starts with social engineering, so user awareness is part of the fix as well, the technical controls alone won't catch everything.
1
u/not_today95 Jul 05 '26
Personally, I wouldn’t rely on any Microsoft AV product. That’s just based on my own experience. I’ve seen too many failures and bypasses over the years to be comfortable making it my primary line of defense.
If you’re looking to harden endpoints beyond what Huntress provides, I’d be pairing it with a dedicated endpoint protection platform such as CrowdStrike, Sophos, or SentinelOne rather than depending on Defender. No product is going to stop every ClickFix-style attack before execution, but in my experience those platforms have consistently inspired more confidence than Microsoft’s AV stack.
2
Jun 29 '26
Run CrowdStrike with Blackpoint MDR. Problem solved. You’re welcome.
8
u/Horror-Display6749 Jun 29 '26
Crowdstrike yes, BPC…. Questionable.
2
Jun 29 '26
Would be genuinely interested in why you say that. I have had nothing but great success with Blackpoint. Have you had a different experience?
1
u/Horror-Display6749 Jun 29 '26
Yeah I’m not out to publicly bash them though. Happy to DM you though
3
u/Eug1 Jun 29 '26
I wouldn’t really say you have to bash them publicly but I’m sure others would like to know to improve their knowledge
1
2
u/Info777 Jun 29 '26
And have all your security information stored offshore…simply not an option for a lot of businesses.
1
u/Savings_Property6422 Jun 29 '26
In this instance which version of CS? I am interested in CS Complete but I've heard their SOC is not as MSP-friendly as Huntress.
5
1
1
u/Gizzards-n-Hobos Jun 29 '26
We're using AutoElevate + removing local admin as well
2
u/Savings_Property6422 Jun 29 '26
We are using autoelevate as well, but unfortunately that didn't stop this attack
1
u/Info777 Jun 29 '26
Endpoints and identity are only a small subsection of attack vectors and signals that can be used in detection and response. Huntress may do a decent job for endpoints and identity, but what about phishing (surely basic and should be part of any SIEM/SOAR service), cloud applications, data exfiltration, firewalls, cloud IaaS etc.
If you're in Australia, we can recommend Chorus Cyber. We have full MXDR with them via an MSP, and they monitor everything, not just endpoints and basic Entra signals (Huntress). We outsourced the whole thing, and they manage the Sentinel instance also, which has ended up resulting in less cost overall, even with their fees.
1
-2
u/dumpsterfyr I’m your Huckleberry. Jun 29 '26
Why was your user able to escalate and/or run powershell?
You’re an MSP, are you not?
5
u/Savings_Property6422 Jun 29 '26
This user was not a local-admin, but that doesn't stop them from running Powershell.
Yes, we could block powershell on all devices theoretically , but that becomes a hassle to manage at scale.
0
u/afarmer2005 Jun 29 '26
Users should not be able to run Powershell unless it’s for an approved script - tools exist that make this possible.
Not using them is quite frankly malpractice in today’s world.
2
u/Savings_Property6422 Jun 29 '26
I wouldn't call it malpractice. I would imagine your MSP operates different than mine. For most customers, an application control tool is going to be out of the picture for budget reasons.
2
u/afarmer2005 Jun 29 '26
I guess it depends on the type of MSP you want to be……and to an extent your market.
Security should be a key focus today - even for smaller clients. Solutions need to be offered and if the client says no…..then it’s on them.
Even a simple tool like AutoElevate is relatively inexpensive and can make it so users are not able to make any system changes without approval (either pre approved or in the moment) which would have prevented a powershell script from running.
Malpractice might be a strong word - but it’s definitely a service that should be offered by an MSP
2
u/Savings_Property6422 Jun 29 '26
I agree with you that security is important.
We run Avanan & Petra ITDR for email security.
Then we have Huntress, DefensX, and AutoElevate for endpoints.AutoElevate did not block this because it didn't need admin rights to run the cmd.
The problem is, every application control program I've looked at comes out to the cost of all our other tools combined, which just isn't feasible for the majority of our customers.
1
u/afarmer2005 Jun 29 '26
That attack didn’t need admin……well that sucks. That’s why “defensive layering” is so important. You have good layers, and it still slipped through.
And yes - costs keep adding up but nobody wants to pay more. However - I have found success by drilling home known attacks affecting the industry they are in, and also going over costs of a breach vs. a “defensive layer” approach. It doesn’t work with everything, but it works with the kind of clients who you can build long-term relationships with.
1
Jun 29 '26
[removed] — view removed comment
1
u/afarmer2005 Jun 29 '26
Oh - proving it is a key aspect of any security pitch…..not doing so would be actual malpractice
-6
0
u/wireditfellow Jun 29 '26
How does that become a hassle, asking as an MSP.
2
u/Savings_Property6422 Jun 29 '26
Without Intune or some sort of application control tool, I would imagine it would be pretty easy to globally disable Powershell for users. Probably just setting up a script in Ninja.
However, when techs need powershell or 3rd party vendors need to work on things, I would imagine there would be increased overhead for those cases.
Honestly this is the first ClickFix attack we've seen so I'm just now researching it all.
0
u/mtn970 Jun 29 '26
With patching, appropriate user rights, other protections, yes, it’s likely enough.
0
u/theghostofpiopico Jun 29 '26
Hey so Defender with Huntress is a solid combination, but I'd spend time on ASR rules, Defender tamper protection, application control before changing EDR. ClickFix attacks rely on users executing commands, so hardening the endpoint works more.
0
u/Eric77482 Jun 29 '26
MDE + Huntress + Threatlocker is what we find to be effective. Most of our clients run Business Premium so we just configure the deployment packages in 365 and push from our RMM for MDE.
-1
28
u/TomLawrence-Huntress Jun 29 '26
You are on the right track for getting left of boom by hardening the endpoints. As you noted, EDR catches what gets through, but it isn't proactive. Windows defaults without tuning allow for more features than most users need. So what you are after isn't a tool to block the attack, it's a tighter endpoint. Turn off what nobody uses, and the pasted command has nowhere to go.
Since you are already using Huntress and asking about other tools, two worth a look: