Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#malware
Newest first
YARA Rules: The Complete Guide for Threat Hunters
Master YARA from zero to hero: full syntax, advanced conditions, modules, optimization and real-world examples to detect malware, ransomware and APTs. A no-nonsense technical guide.
Fuzzy Hashing: Finding Malware Variants with ssdeep, TLSH, and imphash
Exact hashes break the moment an attacker flips one byte. Fuzzy hashing survives mutation: how ssdeep, TLSH, and imphash work, and when to reach for each.
Writing YARA Rules That Don't Melt Your Scanner
Slow YARA rules kill throughput at scale. Learn how the engine really matches with atoms, why short strings and greedy regex hurt, how condition ordering short-circuits work, and how to benchmark and fix your rules.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note