On Detection, Information Security, Research, Detection Engineering.
our disassembler. Once our disassembler has loaded and analyzed it, we see that when a user executes net.exe, it calls the CreateProcessW API function to create a new process called net1.exe. For those unfamiliar, there is a fun story about the creation of net1.exe involving Y2K. After we open