Analyzing Initial Access Across Today's Business Environment | Huntress

This Huntress blog analyzes common initial access vectors seen across Tactical Response cases, finding credential-based logins via exposed RDP/RDG, SMB, and VPN appliances dominate over exploit- and phishing-driven entries. It provides practical guidance on detecting and hardening these avenues—reviewing relevant Windows and VPN telemetry, emphasizing robust MFA configurations (avoiding fail-open), and improving logging/retention (e.g., enabling CLI audit and forwarding to syslog on Fortinet)—to reduce risk from brute force, password spraying, and credential stuffing.