Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Incident Response
Page 2 of 2
Business Email Compromise: The Billion-Dollar Attack Nobody Detects
BEC needs no malware, no exploit, and no payload. Just a convincing email and a wire transfer. Here is how it works, why tools miss it, and what stops it.
Phishing Email Analysis: Headers, EML Files, and Hidden Payloads
A hands-on dissection of a suspicious email: reading the Received chain hop by hop, interpreting SPF, DKIM and DMARC verdicts, and safely extracting URLs and attachments.
Malicious JavaScript Deobfuscation: A Practical Walkthrough
Take an obfuscated JavaScript sample from unreadable to understandable: string arrays, hex escapes, eval chains and packers, dismantled step by step with safe static techniques.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note