Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
All articles
Page 5 of 9
Detection as Code: Versioning, Testing, and Shipping Your Rules
Treat your YARA and Sigma rules like software: git workflows, code review, CI validation, unit tests against real samples, staged rollout, and rollback when a rule goes bad.
Alert Fatigue Is a Design Problem, Not a Staffing Problem
SOCs do not drown because they lack analysts. They drown because the alert pipeline was never designed. Here is a framework for fixing it end to end.
Memory Forensics 101: What Lives in RAM and Why It Matters
An accessible introduction to volatile evidence: what only exists in RAM, when to capture it, and how to start analyzing memory images with Volatility 3.
NIS2 vs DORA vs GDPR: Untangling EU Cybersecurity Regulation
Three EU regulations, three different scopes, one confused compliance team. A clear map of who each one covers, where they overlap, and what to fix first.
The Vulnerabilities Threat Actors Actually Exploit
Attackers do not exploit CVEs at random. Cross-referencing actor profiles with their known exploited vulnerabilities reveals clear patterns you can use to prioritize patching.
Building Incident Playbooks People Actually Follow
Most IR playbooks die in a wiki: too long, written for auditors, never exercised. Here is how to write short, decision-oriented runbooks your team will use at 3 a.m.
Living Off the Land: Detecting LOLBins Before They Detect You
Attackers abuse trusted Windows binaries like certutil, mshta and rundll32 to stay invisible. Here is why signatures fail, how to baseline legitimate use, and how to write Sigma that separates admin work from abuse.
Regex for Security Analysts: Patterns You'll Use Every Week
A practical regex cookbook for log analysis and IOC extraction: IPs, domains, URLs, hashes, base64 and defanged indicators, plus the mistakes that quietly break your matches.
Business Email Compromise: The Billion-Dollar Attack Nobody Detects
BEC needs no malware, no exploit, and no payload. Just a convincing email and a wire transfer. Here is how it works, why tools miss it, and what stops it.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note