What Is A Persistent Foothold?

By Annie Ballew, Huntress

Before Huntress, I always assumed that threat hunting was done like this:

• Gather as much visibility as you could afford
• Make sure it includes sophisticated machine learning, AI, behavioral analytics, [insert buzzword du jour here]
• Find smart security people to constantly tune the engines to sift through and bring the important stuff to the surface

But every solution I saw was expensive, unwieldy, and often very manual. There had to be a better way!

A New Approach to Threat Hunting 

According to Huntress lore, the concept of hunting for footholds was cooked up during our founders’ time at the NSA. As cyber operators, they understood the crucial role that persistent footholds played in the attack chain. Footholds allow attackers to maintain access to their targets—and yet, they often don't get the attention they deserve from defenders.