What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
MSSPs can make ransomware hunts more useful by looking for attacker activity before encryption, covering both customer environments and the provider’s own remote-management systems, and ensuring every lead can be investigated and acted on. Threat hunting can reduce risk, but it cannot guarantee that every foothold will be found or every attack stopped.
Why ransomware hunting must look beyond encryption
Encryption is often the point at which a ransomware incident becomes unmistakable, not necessarily the first sign of an intrusion. An attacker may already have had time to establish access or carry out other activity. Threat hunting is a proactive search for signs of threat-actor activity, intended to help prevent an attack or minimize damage if one succeeds. That is how joint CISA and FBI guidance describes the purpose of hunting; it is not a promise that a hunt will find every foothold.
As an Amazon Associate I earn from qualifying purchases.
For a managed security service provider (MSSP), the search has two connected scopes: the customer systems under management and the provider’s own management plane. A compromise of provider infrastructure or access can put more than one customer at risk. CISA’s Joint Cyber Defense Collaborative has warned that exploitation of remote monitoring and management (RMM) platforms can create footholds in MSP servers and, in turn, customer networks. A customer-only hunt can therefore miss a critical part of the exposure.
Build hunts around evidence that can change a decision
A useful hunt starts with a question and the records needed to answer it. The following leads are identified in CISA’s ransomware guidance. They are investigation prompts, not proof of ransomware by themselves:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Identity and directory changes: newly created or escalated Active Directory accounts, especially where the change is unexpected or its authorization is unclear.
- Privileged-account activity: unusual use of administrative or other high-privilege accounts.
- Remote access: anomalous VPN or other login activity, assessed against the account, source device, timing, and expected customer scope.
- Recovery-impacting endpoint changes: activity that could impair backups, shadow copies, disk journaling, or boot configurations.
These signals gain meaning from context. A legitimate administrator may create an account or change a system during approved maintenance. Validate a lead against the authorized change window, ticket context, account owner, source device, and the systems the person was permitted to access. A raw alert without that context can produce false alarms; a missing or incomplete log can make a real event impossible to assess.
A practical MSSP hunt workflow
This sequence is an operational synthesis of the cited agency recommendations, not a checklist formally prescribed or tested by CISA.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
- Map the scope. Identify the provider’s RMM servers, remote-access paths, privileged service accounts, delegated permissions, and connections into each customer environment. Include customer identities and endpoints in scope rather than treating the provider platform as the whole investigation.
- Check telemetry before starting. Confirm that records are available for identity and directory changes, VPN and other remote access, endpoint activity, network-defense signals, RMM administration, and backup or recovery systems where available. Note gaps and the time periods covered. If a relevant source is absent, state that limitation instead of describing the hunt as complete.
- Investigate the relevant leads. Look for unexpected account creation or privilege escalation, suspicious privileged-account use, unusual remote logins, and endpoint changes that may affect recovery. Use the expected behavior of the particular customer and provider environment to guide triage.
- Join the evidence into a timeline. Compare provider-side and customer-side activity, then validate suspicious events using approved changes, tickets, ownership, device origin, and the access scope granted to the account. Where the same access path touches multiple customers, assess the connected environments rather than stopping at the first affected system.
- Escalate credible findings under the agreed plan. Preserve relevant evidence, coordinate containment with the customer, and check for persistence or activity in other tenants before declaring an environment clean. Response authority and customer responsibilities should be agreed in advance, not improvised during an incident.
- Refresh the hunt hypothesis. Use current threat advisories to update actor-specific techniques and indicators. CISA’s Play ransomware advisory was updated on June 4, 2025 with new tactics, techniques, procedures, and indicators of compromise. That update illustrates why old indicators should not be treated as a complete or permanent description of a threat; check for newer guidance before operational use.
Make telemetry and access controls part of the service
A joint advisory released May 11, 2022 by CISA and partner agencies in the United States, United Kingdom, Australia, Canada, and New Zealand recommends that MSPs and customers monitor and log activity, use endpoint detection and network-defense monitoring, secure remote-access applications, and use multifactor authentication (MFA) where possible. It recommends retaining the most important logs for at least six months. That is a control recommendation in the advisory, not a universal statutory retention requirement; organizations should also check applicable local laws and regulatory obligations.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteLogging matters only if the relevant people can access and interpret it during an investigation. MSSPs and customers should decide which party collects each log source, who can query it, how gaps are reported, and how evidence is preserved. The same advisory recommends developing and exercising incident-response and recovery plans with defined stakeholder roles. CISA’s ransomware guide also recommends least privilege and limiting third-party access to systems needed for the third party’s role. For service providers, those principles translate into reviewing delegated permissions and customer access boundaries, not simply securing a shared login.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
The advisory also recommends managing supply-chain risk across security, legal, and procurement. In practice, customer agreements and operating procedures should make access scope, incident notification, evidence handling, containment authority, and recovery coordination understandable to both parties. The cited guidance is advisory; it does not establish a single contract template or legal rule for every jurisdiction.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Questions to ask when evaluating an MSSP’s hunting service
Official guidance does not provide a formal scorecard for comparing MSSPs. These questions are practical evaluation criteria derived from the guidance, not a vendor ranking:
Rank #4
- PHISHING-RESISTANT 2FA: Cryptographically binds to real domains, making phishing attacks impossible unlike SMS codes or authenticator apps.
- 3-SIDE CAPACITIVE TOUCH: Tap the end, left, or right side to authenticate, so it works in any orientation or crowded USB port.
- MULTI-COLOR LED INDICATOR: Blue means ready, blinking blue means tap now, green means success, and red means error for instant status feedback.
- IP68 WATERPROOF & BATTERY-FREE: Crush-resistant one-piece construction survives daily carry on a keychain or in a bag for years without any batteries.
- UNIVERSAL COMPATIBILITY: Works with Google, Microsoft, Apple, GitHub, AWS, and any FIDO2 / U2F / WebAuthn service, storing up to 100 passkeys.
| Area | Question to ask | What a useful answer should clarify |
|---|---|---|
| Scope | Does hunting cover the provider’s management plane as well as customer systems? | Whether RMM infrastructure, privileged access, customer identities, and endpoints are included, and how connected customers are assessed when provider access is implicated. |
| Telemetry | Which evidence sources can the service actually investigate? | Access to relevant identity, endpoint, network, remote-access, RMM, and backup-impacting events, along with retention periods and known coverage gaps. |
| Hunt method | What kinds of activity trigger investigation? | Whether hunts examine identity anomalies, unusual remote logins, privileged activity, and threats to recovery—not only matches against static indicators. |
| Response | What happens when a finding is credible? | Who can escalate or contain, how evidence is preserved, how the customer is involved, and whether response and recovery roles are exercised. |
| Freshness | How are threat hypotheses and indicators reviewed? | How the service accounts for changes in threat advisories and avoids treating a dated indicator list as exhaustive. |
Ask for clarity on limits as well as capabilities: a service cannot meaningfully investigate data it does not collect or cannot access. A specific tool or indicator feed, on its own, is not evidence that a provider will detect or prevent ransomware.
Recommended Free Tools
Keep the guidance in its proper context
The cited sources are government recommendations, not guarantees of outcome. The May 2022 MSP advisory was issued by U.S. and international partner agencies; CISA’s ransomware guide is a U.S. interagency resource co-authored by CISA, the FBI, NSA, and MS-ISAC. Organizations outside the United States should check local reporting and regulatory requirements. Threat information is also time-sensitive: the Play advisory’s June 4, 2025 update is a dated example, so operational teams should verify whether guidance has changed before relying on it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
