Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Fundamentals
Newest first
Enterprise SSO and SCIM: A Security Checklist That Goes Past "We Have SAML"
SSO concentrates trust in one assertion, so every validation step you skip becomes an authentication bypass. A practical checklist for SAML, OIDC, JIT provisioning, SCIM deprovisioning and break-glass accounts.
Encodings in Malicious Payloads: Recognising and Peeling Base64, Hex, XOR and Friends
Most "obfuscated" payloads are just encoded, sometimes three or four times over. How to recognise Base64, hex, URL encoding, UTF-16LE PowerShell and single-byte XOR at a glance, and how to peel layered encodings without guessing.
Learning CTI and SOC Skills for Free: A Student Roadmap
You do not need a paid bootcamp to become a credible junior analyst. The best free resources for threat intelligence and SOC skills, how to sequence them, and how to turn lab work into a portfolio that hiring managers actually read.
SOC L1/L2 Revision Guide: What to Know Cold Before the Interview
The concepts every SOC analyst interview probes: ports, protocols, HTTP codes, Windows event IDs, Sysmon, regex and CIDR. A compact revision sheet plus sample questions and how strong candidates answer them.
File Signatures and Magic Bytes: Trust the Header, Not the Extension
An extension is a label anyone can change; the first bytes of a file are much harder to fake. A practical guide to magic bytes, extension spoofing, polyglots, container formats like OOXML, ISO and LNK, and carving files out of raw data.
Regex for Security Analysts: Patterns You'll Use Every Week
A practical regex cookbook for log analysis and IOC extraction: IPs, domains, URLs, hashes, base64 and defanged indicators, plus the mistakes that quietly break your matches.
Teaching Kids About Cybersecurity Without Scaring Them
Fear makes kids hide problems instead of reporting them. An age-by-age guide for parents and teachers: passwords, game scams, oversharing, and the hard teen conversations.
JWT Security: Decoding, Attacking, and Defending JSON Web Tokens
JWTs are everywhere and misused everywhere. A practitioner walkthrough of how they work, the classic attacks (alg none, key confusion, weak secrets), and how to validate them safely.
So You Want to Be a SOC Analyst: A Realistic Starting Roadmap
What the job actually looks like, the four skills that matter more than any certification, home-lab ideas that cost nothing, and where the role leads after year two.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note