Best Practices to Reduce Your Attack Surface

This Huntress guidance emphasizes building a comprehensive asset and application inventory as the foundation for reducing attack surface and improving SIEM/EDR signal quality. It highlights risks from unmanaged or legacy remote-access tools (e.g., TeamViewer abused to deploy crypto miners), references recent high-profile software issues (PaperCut, 3CX, MOVEit), and notes threat actors’ shift from Office macros to ISO/VHD and OneNote lures following Microsoft’s macro blocking. The piece recommends configuration hardening and leveraging Huntress’ shared PowerShell controls to mitigate these initial access techniques and streamline incident response.