Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#detection
Newest first
Hunting Persistence on macOS and Linux: Where Attackers Hide and How to Find Them
Most persistence hunting content is written for Windows. Here is the macOS and Linux equivalent: LaunchAgents, login items and BTM, systemd, cron, shell profiles, ld.so.preload, SSH keys and udev, with hunting commands and accurate ATT&CK mappings.
Living Off the Land: Detecting LOLBins Before They Detect You
Attackers abuse trusted Windows binaries like certutil, mshta and rundll32 to stay invisible. Here is why signatures fail, how to baseline legitimate use, and how to write Sigma that separates admin work from abuse.
The Pyramid of Pain Explained: Why Your Hash Feeds Aren't Enough
David Bianco's pyramid of pain ranks indicators by how much they hurt an adversary when you detect them. Most SOCs live at the bottom. Here is how to climb.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note