---
title: "Addressing Initial Access"
url: https://daily.dev/posts/addressing-initial-access-zcsgdu2dr
source_url: https://www.huntress.com/blog/addressing-initial-access
type: article
source: "Huntress Blog"
published: 2026-05-31T07:42:35.816Z
updated: 2026-05-31T08:24:55.074Z
tags: ["security", "malware", "phishing", "powershell"]
reading_time: 6
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Addressing Initial Access

**[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 6 min read · 0 upvotes · 0 comments

## Summary

Threat actors have adapted their initial access techniques following Microsoft's 2022 decision to block macros in Office documents downloaded from the Internet, shifting to disk image files (ISO, IMG, VHD, VHDX) and malicious OneNote files. This post provides ready-to-use PowerShell one-liners that Windows administrators can run to harden endpoints against these attack vectors: disabling embedded file execution in OneNote, blocking automatic mounting of disk image files, and enforcing macro blocking for Office applications downloaded from the Internet — all via direct Windows Registry modifications without needing GPO templates.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.huntress.com/blog/addressing-initial-access>

---

Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing), [#powershell](https://daily.dev/tags/powershell)

[View this post on daily.dev](https://daily.dev/posts/addressing-initial-access-zcsgdu2dr)