Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the mlab team. Written for analysts who want the indicators, the method and the fix.
#identity
Newest first
Enterprise SSO and SCIM: A Security Checklist That Goes Past "We Have SAML"
SSO concentrates trust in one assertion, so every validation step you skip becomes an authentication bypass. A practical checklist for SAML, OIDC, JIT provisioning, SCIM deprovisioning and break-glass accounts.
Infostealers and the Logs Economy: Why Your MFA Did Not Help
Infostealers turn one infected laptop into a ready-to-use bundle of passwords, cookies and tokens, sold within hours. What a stealer log contains, why session theft walks past MFA, and how defenders actually respond.
OAuth Consent, Device Codes and AiTM: Identity Attacks That Skip Your MFA
Attackers stopped trying to beat MFA and started routing around it: illicit consent grants, device code phishing, reverse-proxy kits and push fatigue. How each technique works and how to detect and respond in Entra ID and Microsoft 365.
inkdex: an index that states facts, a scanner that judges them
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note