Written by Lindsey O’Donnell-Welch, Ben Folland, Harlan Carvey of Huntress Labs. A big part of a security analyst’s everyday role is figuring out what actually happened during an incident. We can do that by piecing together breadcrumbs–whether that’s through logs, antivirus detections, and other clues–that help us understand how the attacker achieved initial access and what they did after. However, it’s not always cut and dry: sometimes there are external factors that limit our visibility. The Huntress agent might not be deployed across all endpoints, for example, or the targeted organization might install the Huntress agent after a compromise has already occurred. In these cases, we need to get creative and look at multiple data sources in order to determine what actually happened.…