Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Incident Response
Newest first
OAuth Consent, Device Codes and AiTM: Identity Attacks That Skip Your MFA
Attackers stopped trying to beat MFA and started routing around it: illicit consent grants, device code phishing, reverse-proxy kits and push fatigue. How each technique works and how to detect and respond in Entra ID and Microsoft 365.
Business Email Compromise: The Billion-Dollar Attack Nobody Detects
BEC needs no malware, no exploit, and no payload. Just a convincing email and a wire transfer. Here is how it works, why tools miss it, and what stops it.
Phishing Email Analysis: Headers, EML Files, and Hidden Payloads
A hands-on dissection of a suspicious email: reading the Received chain hop by hop, interpreting SPF, DKIM and DMARC verdicts, and safely extracting URLs and attachments.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note