https://www.hunt-ir.com/huntirs-blog daily 0.75 2026-01-05 https://www.hunt-ir.com/huntirs-blog/before-anything-else-preparation-is-the-key-to-success monthly 0.5 2026-01-01 https://www.hunt-ir.com/huntirs-blog/the-rise-of-credential-monetisation-in-modern-bec-attacks monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/295744e6-a25f-4e6b-ab81-ce3de435cf68/BECMonetisation.png HUNTIRs Blog - Credential Monetisation in BEC Attacks - Make it stand out Stolen Credential Monetisation Pathways https://www.hunt-ir.com/huntirs-blog/cyber-assessment-framework-v4-0 monthly 0.5 2025-12-28 https://www.hunt-ir.com/huntirs-blog/direct-send-the-direct-threat-hidden-in-your-exchange-online-configuration monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1a859cef-8bd9-4755-a4ca-9e46eaf6ac9d/DirectSend1.png HUNTIRs Blog - Direct Send - the direct threat within your Exchange Online configuration - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/e7a1c040-e4f2-4a8e-8232-3a33093ee9d4/DirectSend2.png HUNTIRs Blog - Direct Send - the direct threat within your Exchange Online configuration - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/c78f01e4-2da1-4c7d-ac38-a6c12d9622d8/DirectSend3.jpg HUNTIRs Blog - Direct Send - the direct threat within your Exchange Online configuration - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/12b3485b-3b57-4908-818b-3cd33ba75569/DirectSend4.png HUNTIRs Blog - Direct Send - the direct threat within your Exchange Online configuration - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/d1d07c89-4ae6-4788-b96a-7a4e91bfb5a5/DirectSend5.jpg HUNTIRs Blog - Direct Send - the direct threat within your Exchange Online configuration - If disabling Direct Send is not possible If you can’t enable Reject Direct Send, due to business reasons, you can reduce risk by creating a high-priority mail flow (transport) rule that quarantines any inbound mail not originating from your approved IPs (MX records, on-premises servers, or other authorized senders). Priority: Set to 0 and enable Stop processing more rules. Action: Quarantine the message. Exceptions: Allow messages from approved IPs or those with the X-MS-Exchange-Organization-AuthAs header containing Internal. OR 'X-MS-Exchange-Organization-AuthAs' header contains ''Internal'' https://www.hunt-ir.com/huntirs-blog/phishing-youve-been-framed monthly 0.5 2025-12-07 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1765143025104-2BYVAOP8WCWYW35F60IH/Framer-SignUp.png HUNTIRs Blog - Phishing: You've been framed! https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1765143025162-2AGY0QUJI6JNZSEFLX3M/Framer-SignUp2.png HUNTIRs Blog - Phishing: You've been framed! https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1765143022348-KR7CJPIWMRD5369RNFCI/Framer-Setup1.png HUNTIRs Blog - Phishing: You've been framed! https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1765143023995-BNM8NZL1R69ZCSLZV4YU/Framer-Setup3.png HUNTIRs Blog - Phishing: You've been framed! https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1765143023700-IYS1CYPCZGG7R2764RQR/Framer-Setup2.png HUNTIRs Blog - Phishing: You've been framed! https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1765143022849-D4VO2ZTCRQ1P2ARXB37Q/Framer-Rickroll.png HUNTIRs Blog - Phishing: You've been framed! https://www.hunt-ir.com/huntirs-blog/preparation-essentials monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/e1bd2f51-3397-494a-b4f5-f1a87a942344/PlaybookGIF.gif HUNTIRs Blog - Preparation Essentials - Make it stand out HUNT-IR Playbook https://www.hunt-ir.com/huntirs-blog/connectoricons monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/e4957783-7ce5-4a0e-9b0f-f416b51d51da/ConnectorIcons1.png HUNTIRs Blog - Forensics Blog: Adobe ConnectorIcons - Make it stand out ConnectorIcons viewable in Adobe https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/7496c0cf-67e6-4b0c-a833-7edd57e04318/ConnectorIcons2.png HUNTIRs Blog - Forensics Blog: Adobe ConnectorIcons - Make it stand out ConnectorIcons viewable in Explorer https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/47ae2479-b3f8-4cdd-835a-6e35289f74fe/ConnectorIcons3.png HUNTIRs Blog - Forensics Blog: Adobe ConnectorIcons - Make it stand out No ConnectorIcons visible in Adobe or Explorer after ‘Clear Recent’ selected. https://www.hunt-ir.com/huntirs-blog/teamfiltration-vs-mfa monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/94ea269c-192a-42b4-84f0-ddb4c66d0129/TeamfiltrationMFA1.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/acdf77c8-8687-4d68-8bcf-1adce7c53037/TeamfiltrationMFA2.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/c925cdd9-7ea8-46b1-9c5d-31fefb65fa38/TeamfiltrationMFA3.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/86bd1057-75f9-43b2-b0e9-ae8e054bb0fb/TeamfiltrationMFA4.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/160e6e0a-a4e0-49c3-a45d-256d5f37e862/TeamfiltrationMFA5.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/32b9b6f0-932f-4fab-896e-848780578f5a/TeamfiltrationMFA6.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/81231635-3cc9-43a8-9b13-164e3ea0b6a2/TeamfiltrationMFA7.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/e81f7c5a-cb71-4a95-8782-1d26b751c967/TeamfiltrationMFA8.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1da9da06-ebd8-4b8d-8768-9f36245d8960/TeamfiltrationMFA9.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/52f6bcbf-e460-458a-acf2-8d2a33443ee1/TeamfiltrationMFA10.png HUNTIRs Blog - Teamfiltration vs MFA - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.hunt-ir.com/huntirs-blog/wetransfer-forensics monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1766949295683-70D95WISPQT390BNQCO2/WeTransfer1.png HUNTIRs Blog - Forensics Blog: WeTransfer https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1766949295728-YNTBKM8B3QNXJ3SU91AJ/WeTransfer2.png HUNTIRs Blog - Forensics Blog: WeTransfer https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1766949296766-UJ86SEUPYKCZ9DNF5IZ3/WeTransfer3.png HUNTIRs Blog - Forensics Blog: WeTransfer https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1766949296848-R48990TFPMZZ38ZC8T89/WeTransfer4.png HUNTIRs Blog - Forensics Blog: WeTransfer https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/bb4d76b2-174b-470e-b865-8c189660b3c7/WeTransfer5NonLoggedIn.png HUNTIRs Blog - Forensics Blog: WeTransfer - Once a transfer has been initiated, the user is shown a progress bar which indicates the percentage of the transfer. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/32e693e1-1236-4c66-be6c-1026be002822/WeTransfer6LoggedIn.png HUNTIRs Blog - Forensics Blog: WeTransfer - Interestingly, if you are logged in, and only if you are logged in. The Title of the web page also changes from 'WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free' to '1% - Transferring…' with the percentage increasing in time with that of the transfer. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/c2a646ba-fb3f-4191-b256-d2c4cfa0d081/WeTransfer7.png HUNTIRs Blog - Forensics Blog: WeTransfer - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/83b1f492-f0aa-4322-bb88-c622f34b13f6/WeTransfer8.png HUNTIRs Blog - Forensics Blog: WeTransfer - This is important because when looking at the logged in user’s Google Chrome history where the browser was closed at 100%, the web page Title: 31% - Transferring… was retained for the WeTransfer.com URL. https://www.hunt-ir.com/huntirs-blog/quick-assist-rat monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/c333b652-fad5-43a8-ab00-6616a3d972dd/QuickAssist1.png HUNTIRs Blog - Forensics Blog: Quick Assist RAT? - Make it stand out Screenshot of 'attacker' controlling 'victim' machine https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/da3663ce-f694-481c-bdec-1a07f5608689/QuickAssist2.png HUNTIRs Blog - Forensics Blog: Quick Assist RAT? - Make it stand out Screenshot of victim ‘Share your screen’ pop-up https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/0da6b5fb-29ee-496c-9351-564c973330bb/QuickAssist3.png HUNTIRs Blog - Forensics Blog: Quick Assist RAT? - Make it stand out Screenshot of RDP bitmap cache snippets https://www.hunt-ir.com/huntirs-blog/incognito-forensics monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/61e0ed79-6ab8-44f3-8cfa-128303342079/IncognitoForensics2.png HUNTIRs Blog - Forensics Blog: Unmasking Private Browsing - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/10599402-0dfc-4ae5-872f-7eabf380e9ff/IncognitoForensics1.png HUNTIRs Blog - Forensics Blog: Unmasking Private Browsing - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/e4dde1bc-01c8-44fb-be0a-85c79e40ce2b/IncognitoForensics3.png HUNTIRs Blog - Forensics Blog: Unmasking Private Browsing - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/9ed6307e-4266-4a5a-bd44-7f8713a1014e/IncognitoForensics4.png HUNTIRs Blog - Forensics Blog: Unmasking Private Browsing - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.hunt-ir.com/huntirs-blog/m365-aitm monthly 0.5 2025-12-07 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/f44465d4-f0e9-4ce7-bbd4-f9a3ae07b6e7/AiTM-Phish.png HUNTIRs Blog - Anatomy of an 'AiTM' MFA Bypass - Make it stand out Typical phishing document which contains a link to an attacker's server https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/a70d7472-b856-4c15-b1d9-908abc551e32/AiTM-Diagram.png HUNTIRs Blog - Anatomy of an 'AiTM' MFA Bypass - Make it stand out Diagram of attack technique https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/78b82ea3-e649-41a4-a686-84f38c720ce7/AiTM-SignIns1.png HUNTIRs Blog - Anatomy of an 'AiTM' MFA Bypass - Make it stand out Successful Multifactor Authentication from impossible travel location https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/f5a76bcd-3c4b-4a4c-bdc9-221f92b85038/AiTM-SignIns2.png HUNTIRs Blog - Anatomy of an 'AiTM' MFA Bypass - Make it stand out Successful MFA challenge (interrupt) https://www.hunt-ir.com/huntirs-blog/m365-attack-tools monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/688e80a8-5177-450d-a369-2b59df4762e2/UserAgents1.png HUNTIRs Blog - Microsoft 365: Attack Tool User Agents - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/20a648fc-a2e5-44d7-9340-d5bca1e18ceb/UserAgents2.png HUNTIRs Blog - Microsoft 365: Attack Tool User Agents - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/137c3940-c083-4abd-94b0-5c218ba288fa/UserAgents3.png HUNTIRs Blog - Microsoft 365: Attack Tool User Agents - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/b4b8925b-5faf-4071-aa8d-4698163d73e5/BAV2ROPC.png HUNTIRs Blog - Microsoft 365: Attack Tool User Agents - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/e56041cb-1fa3-4974-ade3-1ed16239e596/AttackToolsPolicy.png HUNTIRs Blog - Microsoft 365: Attack Tool User Agents - Make it stand out Whatever it is, the way you tell your story online can make all the difference. https://www.hunt-ir.com/huntirs-blog/hunting-blog-creating-chainsaw-rules monthly 0.5 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/7772e839-c151-42ac-8232-987c2c484aed/Chainsaw1.png HUNTIRs Blog - Hunting Blog: Creating Chainsaw Rules - Make it stand out Screenshot of Sigma Mapping file https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/ce4dd170-9e2c-4c6d-b143-7dc32af34d40/Chainsaw2.png HUNTIRs Blog - Hunting Blog: Creating Chainsaw Rules - Make it stand out Event Properties of interesting event log https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1482cf0a-73ad-4079-a13f-202b7640dab3/Chainsaw3.png HUNTIRs Blog - Hunting Blog: Creating Chainsaw Rules - Make it stand out Custom Sigma rule https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/14f5446f-e7bc-4423-b76f-2dcb585b557e/Chainsaw4.png HUNTIRs Blog - Hunting Blog: Creating Chainsaw Rules - Make it stand out Command line output https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/208224a6-6963-46b3-9e12-aa9196e697bd/Chainsaw5.png HUNTIRs Blog - Hunting Blog: Creating Chainsaw Rules - Make it stand out CSV output https://www.hunt-ir.com/home daily 1.0 2026-01-21 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1767021788571-KG5UFWTMEVO6YU557MVD/unsplash-image-n9QMxwaTb7c.jpg https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1767021927638-L9PGUHZ4XAFHV28Q9VCI/unsplash-image-rkFIIE9PxH0.jpg https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1767021869397-QTU19129M0HKH7TQFMWH/unsplash-image-VBLHICVh-lI.jpg https://www.hunt-ir.com/about daily 0.75 2025-12-29 https://www.hunt-ir.com/contact daily 0.75 2026-01-20 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1765319477116-V7MLIRF02DA2WOVUSEU1/unsplash-image-pb_lF8VWaPU.jpg https://www.hunt-ir.com/offerings daily 0.75 2026-01-21 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1767022102349-PCPDEKQ01QSXAPXY6JWU/unsplash-image-n9QMxwaTb7c.jpg https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1767022067278-MEMGYOENSEM2EKROYHFW/unsplash-image-rkFIIE9PxH0.jpg https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/1767022177512-LMQ0MZIBT5Z5UBI9TRZP/unsplash-image-VBLHICVh-lI.jpg https://www.hunt-ir.com/offerings/ir-plans daily 0.75 2026-01-20 https://images.squarespace-cdn.com/content/v1/660325c9fd2466229c0cca50/8a5d372a-1c55-4553-8ab4-975c14fa4308/Icon-01.png Incident Response Plans https://images.squarespace-cdn.com/content/v1/660325c9fd2466229c0cca50/9dd2ad18-075a-48ab-b007-e99ee98d96ba/Icon-03.png Incident Response Plans https://images.squarespace-cdn.com/content/v1/660325c9fd2466229c0cca50/70f689aa-021c-49a0-adc5-6b4dad1841f6/Icon-04.png Incident Response Plans https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/f38c5279-209b-414e-816a-33f56af99a9b/GeoPREP.png Incident Response Plans https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/47ac0d33-eaba-4767-b8ee-fd2b40a36839/unsplash-image-NhzhWMtk0E8.jpg https://www.hunt-ir.com/offerings/tabletop-exercises daily 0.75 2025-12-28 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/e71705f6-1932-47f0-bb26-ed7992a4c388/unsplash-image-VBLHICVh-lI.jpg https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/beed1573-7594-4979-a8f3-e44776ebe9e8/Tabletop-Scenario-Matrix.png https://www.hunt-ir.com/offerings/ir-gap-analysis daily 0.75 2025-12-14 https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/2d561bf2-cacb-4c41-939a-e1d9bbd146e0/unsplash-image-Odc4dcsjUBw.jpg https://www.hunt-ir.com/offerings/playbooks daily 0.75 2026-01-20 https://images.squarespace-cdn.com/content/v1/660325c9fd2466229c0cca50/8a5d372a-1c55-4553-8ab4-975c14fa4308/Icon-01.png Incident Response Playbooks https://images.squarespace-cdn.com/content/v1/660325c9fd2466229c0cca50/9dd2ad18-075a-48ab-b007-e99ee98d96ba/Icon-03.png Incident Response Playbooks https://images.squarespace-cdn.com/content/v1/660325c9fd2466229c0cca50/70f689aa-021c-49a0-adc5-6b4dad1841f6/Icon-04.png Incident Response Playbooks https://images.squarespace-cdn.com/content/v1/660325c9fd2466229c0cca50/65074db5-3cad-4dcd-9a3a-50ae553647c2/Icon-02.png Incident Response Playbooks https://images.squarespace-cdn.com/content/v1/6931fcc510c7f85dfabd34a2/87648623-c5a0-4ced-b6cd-e992d5f1a934/Playbook_Prepare_To_Respond.gif https://www.hunt-ir.com/terms-and-conditions daily 0.75 2026-01-04 https://www.hunt-ir.com/prepare-to-respond daily 0.75 2026-01-20