Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
74
Categories
9
Tags
198
Latest
October 20, 2026
All articles
Page 9 of 9
Threat Hunting
YARA vs Sigma: Which Detection Language for Which Job?
YARA matches bytes in files and memory. Sigma matches patterns in logs. A decision framework with side-by-side Mimikatz examples showing when to use each, and when to use both.
6 min
Threat Hunting
Mapping Your Detection Coverage to MITRE ATT&CK (Honestly)
Most ATT&CK heatmaps flatter the SOC that made them. Here is how to build a coverage map that measures depth, survives scrutiny, and tells you which gaps to close first.
6 min
Engineering
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note