Full Report
Don’t underestimate basic attacker tradecraft tactics. Learn how common cybersecurity tradecraft succeeds and get practical tips from the Huntress SOC to shut it down.
Analysis Summary
# Best Practices: Defending Against Common Attacker Tradecraft
## Overview
These practices address "boring" but highly effective cyberattack tactics—such as brute forcing, VPN compromise, and credential theft—which constitute the vast majority of real-world threats. The goal is to move focus away from "black swan" zero-day events and toward hardening the environment against predictable, playbook-driven attacker behaviors.
## Key Recommendations
### Immediate Actions
1. **Audit Remote Access:** Identify all exposed RDP (Remote Desktop Protocol) and VPN instances. Ensure no management interfaces are directly accessible from the public internet.
2. **Review Event Log Retention:** Check Windows event log sizes. If brute force attempts are causing logs to roll over every few minutes, increase log capacity to ensure visibility of attacker activity.
3. **Password Policy Reset:** Enforce strong password requirements and immediately disable accounts that are no longer in use (stale accounts).
4. **Enable MFA:** Mandate Multi-Factor Authentication for all external-facing services (VPNs, Email, Portals).
### Short-term Improvements (1-3 months)
1. **Implement Account Lockout Policies:** Configure thresholds to automatically block IPs or lock accounts after a specific number of failed login attempts to thwart automated brute forcing.
2. **Segment the Network:** Separate critical infrastructure (like ESXi Hypervisors) from general user segments to prevent lateral movement.
3. **Patch Management Baseline:** Establish a rigorous schedule for patching known vulnerabilities in external-facing software, focusing on VPN concentrators and hypervisors.
4. **Endpoint Detection:** Deploy managed EDR (Endpoint Detection and Response) to monitor for subtle tradecraft that blends into normal network noise.
### Long-term Strategy (3+ months)
1. **Identity Threat Detection & Response (ITDR):** Shift focus toward monitoring identity-based anomalies rather than just malware, as attackers increasingly use legitimate credentials.
2. **Zero Trust Architecture:** Work toward a "never trust, always verify" model where internal access is not granted by default simply because a user is on the VPN.
3. **Continuous Testing:** Regularly test security assumptions through breach-and-attack simulations or red-teaming to ensure configurations work as intended in production.
## Implementation Guidance
### For Small Organizations
- Focus on the "Basics": 100% MFA adoption and disabling RDP on the public internet.
- Use managed service providers (MSPs) or managed security tools to compensate for a lack of a 24/7 internal SOC.
### For Medium Organizations
- Implement centralized logging (SIEM) to prevent the "rollover" effect where logs are lost due to brute force volume.
- Prioritize hardening of virtualized infrastructure (ESXi) as these are high-value targets for ransomware.
### For Large Enterprises
- Focus on lateral movement defenses. Even if an attacker gains entry via "boring" tradecraft, segmenting the network prevents a total breach.
- Automate the identification of "shadow" IT or unauthorized VPNs set up by departments outside of central IT.
## Configuration Examples
- **Windows Event Logs:** Increase `Maximum log size (KB)` in Event Viewer for Security logs to at least 1GB to preserve forensic data during high-volume attacks.
- **VPN Hardening:** Disable legacy authentication protocols (e.g., PAP, MS-CHAPv1) and restrict VPN access to specific geographic regions if business needs allow (Geo-fencing).
## Compliance Alignment
- **NIST CSF:** Aligns with "Protect" (Identity Management/Access Control) and "Detect" (Continuous Monitoring).
- **CIS Controls:** Specifically Control 4 (Secure Configuration), Control 5 (Account Management), and Control 6 (Access Control Management).
- **ISO 27001:** Maps to Annex A controls regarding logging, monitoring, and privileged access rights.
## Common Pitfalls to Avoid
- **"Set and Forget" Security:** Assuming a VPN or Firewall is secure just because it was configured correctly once.
- **Ignoring "Failed" Logins:** Overlooking high volumes of failed logins because "the system blocked them." These are indicators of active reconnaissance.
- **Over-reliance on Software:** Believing software alone stops attacks without human analysis to differentiate between legitimate admin tools and attacker tradecraft.
## Resources
- **Huntress Tradecraft Tuesday:** [https://www.huntress.com/tradecraft-tuesday] (Defanged)
- **CISA Guide on Securing Remote Desktop:** [cisa[.]gov/news-events/analysis-reports/ar21-112a]
- **MITRE ATT&CK Framework (Brute Force):** [attack[.]mitre[.]org/techniques/T1110/]