Behind the Scenes: Crushing Cybercriminals with MAV | Huntress

Huntress describes an intrusion in which an attacker brute-forced a public SQL Server (port 1433), deployed a malicious batch script that disabled Defender protections and deployed Meterpreter; Microsoft Defender alerted analysts who pivoted to EDR, external recon and logs to investigate, isolate the host, and provide remediation and detection guidance (including a Sigma rule) to partners and the community.