Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Incident Response
Page 1 of 2
What Your Files Say About You: EXIF and Document Metadata for OSINT and DFIR
Photos carry GPS coordinates and camera serials; Office files and PDFs carry usernames, software versions, edit history and sometimes the text you thought you deleted. What leaks, how to extract it, how stripping works, and where analysts get fooled.
Incident Case Management: From First Alert to Final Report
Most incident response failures are bookkeeping failures: lost evidence, timelines rebuilt from memory, reports nobody can defend. How to run a case from the moment an alert gets promoted to the day the report ships.
Investigating Smishing Campaigns and Suspicious Phone Numbers
Parcel fees, unpaid tolls, blocked bank cards: SMS phishing is cheap, mobile first and hard to see from the SOC. How to read a sender number or ID, what carrier and VoIP data really tells you, how to unwrap the link, and where to report so the campaign actually gets disrupted.
OAuth Consent, Device Codes and AiTM: Identity Attacks That Skip Your MFA
Attackers stopped trying to beat MFA and started routing around it: illicit consent grants, device code phishing, reverse-proxy kits and push fatigue. How each technique works and how to detect and respond in Entra ID and Microsoft 365.
Analysing Malicious Office Documents: Macros, XLM, Templates and Safe Triage
Office documents remain a delivery vehicle even after Microsoft's macro blocking. How VBA, Excel 4.0 macros, remote templates and external links work, what OLE and OOXML look like inside, and a triage workflow that never requires opening the file in Office.
Ransomware Response: The Decisions That Matter in the First 24 Hours
Ransomware response is a sequence of decisions, not a timeline. Isolate or observe, verify backups before promising recovery, scope exfiltration, and start the legal clocks on time.
The First 60 Minutes: An Incident Response Checklist That Works Under Stress
When an alert turns real, the first hour decides the investigation. A concrete checklist for validating, scoping, preserving evidence, and avoiding the mistakes that cannot be undone.
Memory Forensics 101: What Lives in RAM and Why It Matters
An accessible introduction to volatile evidence: what only exists in RAM, when to capture it, and how to start analyzing memory images with Volatility 3.
Building Incident Playbooks People Actually Follow
Most IR playbooks die in a wiki: too long, written for auditors, never exercised. Here is how to write short, decision-oriented runbooks your team will use at 3 a.m.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note