So Fresh, So Clean: Huntress’ Top Cyber Hygiene Tips
This article outlines foundational cybersecurity hygiene practices recommended by the Huntress SOC to reduce organizational attack surfaces. Key recommendations include enforcing MFA, securing or disabling exposed RDP, implementing strict access controls, and monitoring for behavioral indicators of compromise such as defense evasion, domain enumeration, and privilege escalation.
Authors: Huntress SOC
What Happened
Cybercriminals are constantly looking for easy ways into company networks to steal data or deploy ransomware. This article explains how organizations can stop them by using basic security habits, like turning on multi-factor authentication (MFA), updating software regularly, and using strong, unique passwords. These simple steps make it much harder for hackers to succeed. Everyone should review their security settings and make sure these basic protections are in place.
Key Takeaways
- Enforce Multi-Factor Authentication (MFA) on all external-facing services, including email, VPNs, and payment portals.
- Disable internet-exposed Remote Desktop Protocol (RDP) or secure it behind a VPN with MFA to prevent brute-force attacks.
- Automate software patching to eliminate known vulnerabilities that attackers actively scan for.
- Eliminate password reuse and weak passwords by utilizing secure password managers.
- Monitor for behavioral red flags such as Microsoft Defender modifications, unexpected registry changes, and log clearing.
Affected Systems
- Windows
- Remote Desktop Protocol (RDP)
- Microsoft 365
- VPNs
- Microsoft Defender
Attack Chain
Threat actors typically gain initial access through phishing, brute-forcing exposed RDP, or exploiting unpatched vulnerabilities. Once inside, they attempt to escalate privileges, enumerate domains, and modify security controls like Microsoft Defender. Finally, attackers may clear logs to cover their tracks before deploying ransomware or exfiltrating sensitive data.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules, but recommends utilizing EDR, SIEM, and ITDR solutions to monitor for behavioral anomalies.
Detection Engineering Assessment
EDR Visibility: High — EDR solutions are well-suited to detect the behavioral red flags mentioned, such as Defender modifications, registry changes, and log clearing. Network Visibility: Medium — Network monitoring can detect exposed RDP brute-forcing and strange domain enumeration, but encrypted traffic may hide some lateral movement. Detection Difficulty: Moderate — While brute force and log clearing are relatively easy to detect, distinguishing legitimate administrative registry modifications from malicious ones requires baseline tuning.
Required Log Sources
- Windows Event Logs (Security, System)
- Microsoft Defender Logs
- VPN/Authentication Logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Threat actors are attempting to disable or modify Microsoft Defender to evade detection. | EDR process execution and registry modification logs. | Defense Evasion | Low |
| Attackers are brute-forcing exposed RDP endpoints to gain initial access. | Windows Security Event ID 4625 (Failed Logon). | Initial Access | Low |
| Adversaries are clearing Windows event logs to cover their tracks. | Windows Security Event ID 1102 (Audit log cleared). | Defense Evasion | Low |
Control Gaps
- Lack of MFA on external services
- Internet-exposed RDP
- Unpatched software and firmware
- Excessive user permissions (Privilege Creep)
Key Behavioral Indicators
- Unexpected registry modifications
- Microsoft Defender modifications
- Logs and forensics clearing
- Strange domain enumeration
False Positive Assessment
- Low
Recommendations
Immediate Mitigation
- Enforce MFA on all external-facing services (email, VPNs, payment portals).
- Disable exposed RDP or place it behind a VPN with MFA.
- Audit and revoke excessive user permissions to enforce the principle of least privilege.
Infrastructure Hardening
- Automate software and OS patching.
- Implement complex conditional access policies for critical resources.
- Create strict allow and deny lists for applications and network traffic.
- Implement a 3-2-1 backup strategy and test restorations quarterly.
User Protection
- Deploy a secure password manager and enforce unique, complex passwords.
- Implement EDR to monitor endpoint behavior 24/7.
Security Awareness
- Train employees to recognize and report phishing, vishing, and smishing attempts.
- Educate users on the risks of password reuse and weak passwords.
MITRE ATT&CK Mapping
- T1133 - External Remote Services
- T1110 - Brute Force
- T1566 - Phishing
- T1562.001 - Impair Defenses: Disable or Modify Tools
- T1482 - Domain Trust Discovery
- T1112 - Modify Registry
- T1070 - Indicator Removal
