All Huntress Blog Posts

A suspicious Run Key value with a random name triggered a Huntress alert. What came next was a DLL payload hidden multiple layers deep. Here's the full malware deep dive from first alert to final payload.

Windows administrative shares are built-in features that most administrators know exist and few actively monitor. Here's how attackers use them for lateral movement, and what detection looks like.

An executable that compiles a DLL on the fly, loads it, then decodes an embedded image to deliver its payload. Huntress peels back every layer of this .NET malware and shows what's inside.

Living-off-the-land attacks use a system's own tools against it. Huntress examines a malicious PowerShell payload found in the wild, and walks through the execution chain step by step.

A file that looks like an application log — timestamps, OS version references, nothing alarming. It was actually malware. Huntress breaks down the tricks used to hide a persistent foothold in plain sight.

The Huntress SOC spotted a LNK file reading its payload from itself (not the registry). A deep dive into a clever technique for executing malware through Windows shortcut files.