Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
All articles
Page 6 of 9
The IOC Lifecycle: Aging, Expiration, and Why Old Indicators Hurt You
Indicators of compromise have a shelf life. How to score, decay, and retire IOCs before your stale blocklist starts paging on-call for legitimate CDN traffic.
SOC Metrics That Matter: Beyond MTTR
Most SOC dashboards measure activity, not security. Here are the metrics that actually improve detection and response, the ones that incentivize bad behavior, and how to report both to leadership.
Hunting Cobalt Strike: Beacons, Named Pipes, and Malleable Profiles
A hands-on playbook for hunting Cobalt Strike: how Beacon works, network and named pipe signatures, malleable C2 profiles, memory indicators, ready-to-use YARA and Sigma rules, and post-detection triage.
IOC Analysis Step-by-Step: A Complete Guide for Threat Hunters
A complete, practitioner-focused guide to Indicator of Compromise analysis: from IP addresses and domains to file hashes and network artifacts. Includes real-world examples, tooling, automation scripts, and MITRE ATT&CK mapping.
YARA Rules: The Complete Guide for Threat Hunters
Master YARA from zero to hero: full syntax, advanced conditions, modules, optimization and real-world examples to detect malware, ransomware and APTs. A no-nonsense technical guide.
Welcome to the Mlab Blog
Why we launched this blog and what you can expect: threat intelligence deep-dives, DFIR notes, product changelogs and short, actionable cybersecurity reads.
CVSS, EPSS, KEV: How to Actually Prioritize Vulnerabilities
Patching by CVSS score alone drowns your team in criticals that will never be exploited. Here is how to combine CVSS, EPSS, and CISA KEV into a priority queue that works.
WHOIS Is Dead, Long Live WHOIS: Investigating Domains After GDPR
GDPR redacted the registrant fields investigators relied on for decades. Domain attribution still works, but the pivots have moved: RDAP, name servers, certificates, and history.
Teaching Kids About Cybersecurity Without Scaring Them
Fear makes kids hide problems instead of reporting them. An age-by-age guide for parents and teachers: passwords, game scams, oversharing, and the hard teen conversations.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note