A suspicious Run Key value with a random name triggered a Huntress alert. What came next was a DLL payload hidden multiple layers deep. Here's the full malware deep dive from first alert to final payload.
Windows administrative shares are built-in features that most administrators know exist and few actively monitor. Here's how attackers use them for lateral movement, and what detection looks like.
An executable that compiles a DLL on the fly, loads it, then decodes an embedded image to deliver its payload. Huntress peels back every layer of this .NET malware and shows what's inside.
Living-off-the-land attacks use a system's own tools against it. Huntress examines a malicious PowerShell payload found in the wild, and walks through the execution chain step by step.
A file that looks like an application log — timestamps, OS version references, nothing alarming. It was actually malware. Huntress breaks down the tricks used to hide a persistent foothold in plain sight.
Software update processes are attack surfaces. Huntress details the development journey of replacing their third-party agent update utility — and what they found about the security trade-offs.
Watch Huntress for a cybersecurity training event to strengthen your hacking skills and grow the MSP-focused security researcher community.
Watch Kyle Hanslovan and other members of the Huntress team dive into the story of Huntress Managed Antivirus.
Watch Huntress' Hack_It 2020 cybersecurity training event to strengthen your hacking skills and grow the MSP-focused security researcher community.
