A suspicious Run Key value with a random name triggered a Huntress alert. What came next was a DLL payload hidden multiple layers deep. Here's the full malware deep dive from first alert to final payload.

Windows administrative shares are built-in features that most administrators know exist and few actively monitor. Here's how attackers use them for lateral movement, and what detection looks like.

An executable that compiles a DLL on the fly, loads it, then decodes an embedded image to deliver its payload. Huntress peels back every layer of this .NET malware and shows what's inside.

Living-off-the-land attacks use a system's own tools against it. Huntress examines a malicious PowerShell payload found in the wild, and walks through the execution chain step by step.

A file that looks like an application log — timestamps, OS version references, nothing alarming. It was actually malware. Huntress breaks down the tricks used to hide a persistent foothold in plain sight.

Software update processes are attack surfaces. Huntress details the development journey of replacing their third-party agent update utility — and what they found about the security trade-offs.

The Huntress SOC spotted a LNK file reading its payload from itself (not the registry). A deep dive into a clever technique for executing malware through Windows shortcut files.

Hiding malicious activity inside trusted applications is well-known. The technique of nested execution is less discussed. Huntress breaks down why it works and how researchers find vulnerable host applications.