Addressing Initial Access

Huntress outlines practical, copy/paste PowerShell one-liners to harden Windows endpoints against common initial access techniques, including blocking execution of embedded content in OneNote files, preventing automatic mounting of disk images (ISO/IMG/VHD/VHDX) via double-click, and enforcing Office macro blocking for files from the internet. The guidance leverages direct Registry modifications (instead of importing GPO templates) to quickly reduce attack surface and disrupt malware delivery methods (e.g., phishing with OneNote or disk images) across users and Office versions.