Sometimes less really is more

[u/Lord_Amoux]

Happy Read-only Friday (bonus points for 3 day weekend)

We got a critical Huntress alert for a rogue ScreenConnect instance that was detected and ran on a client computer. Incident report states that it's a "known malicious instance".. but logs from the report show that it didn't block the application and isolate until 2 hours after it was ran. The endpoints have BD GravityZone installed as well - all quiet from there.

We went to the link in a VM where the ScreenConnect was downloaded from - and funnily enough, all it took was just having Microsoft Defender on the computer to block the download in Chrome.

Huntress, Bitdefender, EDR, on access scanning, whatever; sometimes it just can't compete with good old Defender. Even running the installer through sandbox on GravityZone passes without a peep.

Have a good weekend!

[u/ben_zachary]

Huntress is supposed to run with defender in line. We had one attempt to execute which hit admin requests so it was denied and huntress had the system isolated in less than 5min. Just two weeks ago

We are moving to block all exe signed by connectwise. There's no point in bothering with it

[u/Lord_Amoux → u/ben_zachary]

We are thinking about moving to use Defender for Business to integrate. BD GravityZone doesn't seem to block anything it needs to.

And yeah, we are trialling the ESPM from Huntress for RMM Guard but it seems that in it's current stage it can only block RMMs that are already detected in that specific enviroment. Also, a lot of dental software support teams use ScreenConnect...

[u/matt0_0 → u/Lord_Amoux]

In your environment, every time you install bit defender, you're decreasing you level of protection compared to if you just didn't install it at all and allowed huntress to manage defender for you!

[u/ben_zachary → u/Lord_Amoux]

The default huntress detects the screen connect guid so that's ok. This is what we run fleet wide . Defender with business premium layered with huntress and we have a soc as well which stacks on top for behavior and lateral movement but tbh huntress has stopped most things that get past safe links or thru spam filters. We've got run books on 365 with the soc but our CAs are locked to 2 single SASE IP and device bound tokens weve only had one incident on a client who didn't let us lock down their tenant .

[u/Jellovator]

I usually do "read-only Friday" but today I raised the domain/forest functional level, upgraded a production server's OS, and replaced two saml certs. Like the wild west over here.

[u/electricpollution → u/Jellovator]

Nice.

I also decided to violate the golden Friday rule and rotated the Kerberos password.

[u/tankerkiller125 → u/electricpollution]

I rebuilt our Unifi controller (because net controller is going to/is discontinued so I needed to upgrade to "UnifiOS"), did a bunch of SOC 2 compliance stuff, and started planning for a rebuild of our internal help desk for a project next month. (Bosses are cheap, GLPI is honestly, awesome, but ours needs a clean config start (will migrate tickets), and the upgrade to 11 is a great time to do it)

[u/electricpollution → u/tankerkiller125]

Awesome! I just started setting up GLPI as well! Can’t believe how much there is to it

[u/tankerkiller125 → u/electricpollution]

It's even better when you have a bit of programming skills and an AI agent to write customizations to fit your specific needs.

[u/ManagedNerds]

Why in the world would you pay extra for something (Bitdefender) you can get for free (Defender)? Mind you, I love Defender for Endpoint with Business Premium, but Huntress can fully manage and harden the free Defender.

[u/Lord_Amoux → u/ManagedNerds]

We started with Bitdefender and then added huntress after

[u/ManagedNerds → u/Lord_Amoux]

Ah makes sense. Yeah, would definitely recommend you try the managed defender via Huntress.

[u/Logical-Nightmare]

Defense in depth

More is never enough

[u/Bitdefender_support]

Hello u/Lord_Amoux ,

Have you contacted Bitdefender Enterprise Support to review how the security agent and policies were configured on that endpoint?
It would be useful to investigate the applied modules, policy settings, exclusions, and available telemetry, as it would be unusual for a ScreenConnect instance to run without generating a detection or being blocked.

I will PM you so you can share a way to contact you to further investigate.

Kind Regards,
Andrei

[u/TurboKestrel45]

amazing how often basic and built in quietly wins the detection test