Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
All articles
Page 3 of 9
OAuth Consent, Device Codes and AiTM: Identity Attacks That Skip Your MFA
Attackers stopped trying to beat MFA and started routing around it: illicit consent grants, device code phishing, reverse-proxy kits and push fatigue. How each technique works and how to detect and respond in Entra ID and Microsoft 365.
File Signatures and Magic Bytes: Trust the Header, Not the Extension
An extension is a label anyone can change; the first bytes of a file are much harder to fake. A practical guide to magic bytes, extension spoofing, polyglots, container formats like OOXML, ISO and LNK, and carving files out of raw data.
Hunting Persistence on macOS and Linux: Where Attackers Hide and How to Find Them
Most persistence hunting content is written for Windows. Here is the macOS and Linux equivalent: LaunchAgents, login items and BTM, systemd, cron, shell profiles, ld.so.preload, SSH keys and udev, with hunting commands and accurate ATT&CK mappings.
Certificate Transparency for Phishing Hunters: Catch the Domain Before the Email
Almost every phishing site wants a padlock, and every publicly trusted certificate is written to a public log. How to read an X.509 certificate, how Certificate Transparency works, and how to turn CT logs into an early warning feed for lookalike domains.
Cloud Threat Hunting: CloudTrail, Entra ID and the M365 Audit Log
In the cloud there is no disk to image and no process tree to walk. The logs are the evidence. Which AWS, Azure, Entra ID and Microsoft 365 events matter most, what they look like when attackers use them, and queries to start hunting today.
Webhooks as Lightweight SOAR: Patterns, Signatures and Idempotency
You do not need a SOAR platform to automate the first ten steps of triage. A signed webhook, a small receiver and a few disciplined patterns get you most of the way. Here is how to build one that does not fall over or get spoofed.
Analysing Malicious Office Documents: Macros, XLM, Templates and Safe Triage
Office documents remain a delivery vehicle even after Microsoft's macro blocking. How VBA, Excel 4.0 macros, remote templates and external links work, what OLE and OOXML look like inside, and a triage workflow that never requires opening the file in Office.
How to Read a CTI Report Like an Analyst (Not a Journalist)
Vendor threat reports mix marketing, narrative, and actionable intelligence. A repeatable method for extracting IOCs, TTPs, and detection opportunities while filtering the noise.
Exploit Prediction with EPSS: What the Score Means and What It Does Not
EPSS gives every CVE a daily probability of exploitation in the wild. Here is what the model actually predicts, how to read scores versus percentiles, and where the number stops helping.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note