Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#ioc
Newest first
Regex for Security Analysts: Patterns You'll Use Every Week
A practical regex cookbook for log analysis and IOC extraction: IPs, domains, URLs, hashes, base64 and defanged indicators, plus the mistakes that quietly break your matches.
The IOC Lifecycle: Aging, Expiration, and Why Old Indicators Hurt You
Indicators of compromise have a shelf life. How to score, decay, and retire IOCs before your stale blocklist starts paging on-call for legitimate CDN traffic.
IOC Analysis Step-by-Step: A Complete Guide for Threat Hunters
A complete, practitioner-focused guide to Indicator of Compromise analysis: from IP addresses and domains to file hashes and network artifacts. Includes real-world examples, tooling, automation scripts, and MITRE ATT&CK mapping.
YARA Rules: The Complete Guide for Threat Hunters
Master YARA from zero to hero: full syntax, advanced conditions, modules, optimization and real-world examples to detect malware, ransomware and APTs. A no-nonsense technical guide.
Understanding IOCs: A Practical Primer
A grounded introduction to Indicators of Compromise — what they are, where they break, and how to actually use them inside a SOC workflow without drowning in false positives.
Automating IOC Enrichment with the mlab.sh API
From a raw indicator list to enriched, scored, SIEM-ready intel: a hands-on Python tutorial covering auth, batch lookups, rate limits, caching, and export.
The Pyramid of Pain Explained: Why Your Hash Feeds Aren't Enough
David Bianco's pyramid of pain ranks indicators by how much they hurt an adversary when you detect them. Most SOCs live at the bottom. Here is how to climb.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note