Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
All articles
Page 8 of 9
Fuzzy Hashing: Finding Malware Variants with ssdeep, TLSH, and imphash
Exact hashes break the moment an attacker flips one byte. Fuzzy hashing survives mutation: how ssdeep, TLSH, and imphash work, and when to reach for each.
Writing YARA Rules That Don't Melt Your Scanner
Slow YARA rules kill throughput at scale. Learn how the engine really matches with atoms, why short strings and greedy regex hurt, how condition ordering short-circuits work, and how to benchmark and fix your rules.
So You Want to Be a SOC Analyst: A Realistic Starting Roadmap
What the job actually looks like, the four skills that matter more than any certification, home-lab ideas that cost nothing, and where the role leads after year two.
Malicious JavaScript Deobfuscation: A Practical Walkthrough
Take an obfuscated JavaScript sample from unreadable to understandable: string arrays, hex escapes, eval chains and packers, dismantled step by step with safe static techniques.
DORA Explained for Security Teams: What Changes in Practice
The EU Digital Operational Resilience Act translated into engineering terms: who is in scope, what incident reporting really requires, TLPT, and why your vendor register just became a regulated artifact.
Geolocation and ASN Analysis: What an IP Address Really Tells You
An IP address is not a person, a place, or a verdict. What geolocation and ASN data actually reveal, where they mislead, and how to use them in triage.
Threat Actor Naming Hell: APT28, Fancy Bear, or STRONTIUM?
The same Russian intrusion set answers to at least eight names. Why vendors refuse to share a naming scheme, how each taxonomy works, and how to keep your own alias registry sane.
The Pyramid of Pain Explained: Why Your Hash Feeds Aren't Enough
David Bianco's pyramid of pain ranks indicators by how much they hurt an adversary when you detect them. Most SOCs live at the bottom. Here is how to climb.
Sigma Rules: The Complete Guide for Detection Engineers
Master Sigma from rule anatomy to SIEM conversion: logsources, field modifiers, condition logic, correlation rules and real detection examples for PowerShell abuse, LSASS access and persistence.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note