Defensive Evasion: Detecting the Threat Actor's Playbook w/ Max Rogers

Huntress Intrusion Context

Max Rogers, Huntress threat operations director, says their MDR service sees several hands-on intrusions weekly across 1.6 million endpoints, mostly ransomware-focused actors in SMB environments.

MITRE Defensive Evasion Focus

He traces kill-chain models to MITRE ATT&CK and argues evasion targets security technology more than human observers. Mid-market attackers act flagrantly once AV or EDR is disabled.

Real-World Evasion Tactics

Examples include abusing existing Microsoft Defender exclusion paths, manually adding broad exclusions after landing, and renaming malware to .log extensions to bypass Defender entirely.

Detection Implications

Defenders should monitor exclusion changes, understand who evasion is meant to fool, and hunt for playbook-like sequences rather than assuming stealthy nation-state tradecraft.