Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Latest
Newest first
More articles
Page 1 of 9
Crypto Address Investigation for SOC Analysts: What the Chain Can and Cannot Tell You
Ransom notes, sextortion emails, drainer kits and fake invoices all end in a wallet address. A practical primer on address formats, clustering heuristics, mixers and bridges, and the legal care an analyst needs before following the money.
Enterprise SSO and SCIM: A Security Checklist That Goes Past "We Have SAML"
SSO concentrates trust in one assertion, so every validation step you skip becomes an authentication bypass. A practical checklist for SAML, OIDC, JIT provisioning, SCIM deprovisioning and break-glass accounts.
Your Organisation Is in a Data Breach: A France and EU Response Guide
Your data just showed up in a leak, or you just found an intruder. The GDPR clock is already running. A practical walkthrough of Articles 33 and 34, the CNIL notification, evidence, communication, credential resets and the French support ecosystem.
Encodings in Malicious Payloads: Recognising and Peeling Base64, Hex, XOR and Friends
Most "obfuscated" payloads are just encoded, sometimes three or four times over. How to recognise Base64, hex, URL encoding, UTF-16LE PowerShell and single-byte XOR at a glance, and how to peel layered encodings without guessing.
Learning CTI and SOC Skills for Free: A Student Roadmap
You do not need a paid bootcamp to become a credible junior analyst. The best free resources for threat intelligence and SOC skills, how to sequence them, and how to turn lab work into a portfolio that hiring managers actually read.
Malicious Open-Source Packages: How They Get In and How to Keep Them Out
Typosquats, dependency confusion, hijacked maintainers, install scripts and protestware all exploit the same reflex: trusting whatever the registry hands you. How each technique works, how to vet a dependency in ten minutes, and why a release cooldown is the cheapest control you are not using.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note