Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

APIs are essential in today's digital landscape, supporting everything from mobile apps to vital backend systems. As their importance grows, they also become attractive targets for advanced attackers who bypass traditional security methods. These adversaries do not simply exploit API flaws; instead, they mimic normal user behavior to launch subtle, slow-and-low attacks that are difficult for conventional tools to detect.

Today’s enterprising adversaries are weaponizing AI to scale operations, accelerate attacks, and target the autonomous AI agents quickly transforming modern businesses. The CrowdStrike 2025 Threat Hunting Report details this new chapter in the threat landscape. This year’s report, based on frontline intelligence from CrowdStrike’s elite threat hunters and intelligence analysts, examines how threat actors are using AI to do more with less.

In this article, we’ll analyze how threat actors exploit TLS to hide their operations and how defenders can use exposed certificate metadata to detect them. We will discuss: Let’s get started! (This article is part of our Threat Hunting with Splunk series. We’ve updated it recently to maximize your value.)

Traditional endpoint defenses that rely solely on signatures and alerts often miss stealthy, livingofftheland attacks—studies indicate that as many as 90% of breaches begin at the endpoint and over twothirds of organizations suffer successful endpoint incursions. When these threats go undetected, they can dwell for months, resulting in data exfiltration, regulatory fines, and lasting reputational damage.

Recently, our team came across an alert involving mshta.exe, a native Windows tool that attackers commonly exploit for malicious purposes. MSHTA (Microsoft HTML Application Host) is a well-known LOLBin (Living-Off-The-Land Binary). This means it is a legitimate system tool that can be abused and can blend in with normal activity. MSHTA can execute remote HTML applications or JavaScript content directly from a URL.

While security professionals know well that a defense-in-depth strategy is crucial to proper cybersecurity, sometimes a detailed story of how a threat was discovered and eradicated can bring the value home, especially to the uninitiated. This is one such story. In this case, the story relates to the value of employing a cybersecurity threat hunting service alongside a managed detection and response offering.

CrowdStrike is launching new innovations to power the AI-native security operations center (SOC) and help teams hunt and resolve threats with speed and accuracy. A new solution, CrowdStrike Falcon Adversary OverWatch Next-Gen SIEM, will bring managed threat hunting to available third-party data and extend the visibility of CrowdStrike’s elite threat hunters into unmanaged attack surfaces.

Stealthy adversaries continually exploit system utilities to execute malicious code. A particularly potent and frequently misused tactic is MITRE ATT&CK T1059 - Command and Scripting Interpreter, wherein attackers harness built-in interpreters like PowerShell, Bash, Python, or JavaScript to run arbitrary commands.

Success in threat hunting is vastly different from incident response. Incident responders can measure success in criteria like ticket volume, mean time to close, or escalations. For threat hunting, the number of hunts vs. incidents is not comparable because hunts take longer, and the average time to complete a hunt can vary wildly. More importantly, most hunts will not result in incidents. We can’t use the same metrics! Our critical metrics of success are our outputs/deliverables and documentation.