Deobfuscation Lab on Matt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/series/deobfuscation-lab/Recent content in Deobfuscation Lab on Matt Swann — Detection Engineering & Threat IntelMatt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/og-image.pnghttp://mattswann.dev/og-image.pngHugoen-usThu, 12 Feb 2026 23:26:36 -0700AppDomainManager Injection — Bend .NET Assemblies to Your Willhttp://mattswann.dev/posts/appdomainmanager-injection/Thu, 12 Feb 2026 23:26:36 -0700http://mattswann.dev/posts/appdomainmanager-injection/A deep dive into AppDomainManager injection (T1574.014): how attackers use .NET’s own extensibility model to proxy execution of malicious assemblies through legitimate signed binaries, and what defenders can — and can’t — do about it.Advent of Cyber 2025 Day 21 — Malware Analysis Bonus Challengehttp://mattswann.dev/posts/advent-of-cyber-2025-day21-bonus/Sun, 21 Dec 2025 23:39:55 -0700http://mattswann.dev/posts/advent-of-cyber-2025-day21-bonus/A walkthrough of the TryHackMe Advent of Cyber 2025 Day 21 bonus challenge: peeling back a multi-layer HTA payload through VBScript analysis, Base64 decoding, and XOR decryption to uncover a hidden PNG.