Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
49
Categories
9
Tags
142
Latest
July 10, 2026
#detection
Newest first
Threat Hunting
Living Off the Land: Detecting LOLBins Before They Detect You
Attackers abuse trusted Windows binaries like certutil, mshta and rundll32 to stay invisible. Here is why signatures fail, how to baseline legitimate use, and how to write Sigma that separates admin work from abuse.
7 min
Threat Intelligence
The Pyramid of Pain Explained: Why Your Hash Feeds Aren't Enough
David Bianco's pyramid of pain ranks indicators by how much they hurt an adversary when you detect them. Most SOCs live at the bottom. Here is how to climb.
7 min
Engineering
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note