Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#c2
Newest first
User-Agent Analysis: Spotting Bots, Scanners, Scripted Clients and C2
The User-Agent header is attacker-controlled, which makes it useless as proof and surprisingly useful as a hunting lead. How to parse UAs, stack-count them, and catch the mismatches that give away bots, scripts and C2 beacons.
Hunting Cobalt Strike: Beacons, Named Pipes, and Malleable Profiles
A hands-on playbook for hunting Cobalt Strike: how Beacon works, network and named pipe signatures, malleable C2 profiles, memory indicators, ready-to-use YARA and Sigma rules, and post-detection triage.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note