Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#sigma
Newest first
Detection as Code: Versioning, Testing, and Shipping Your Rules
Treat your YARA and Sigma rules like software: git workflows, code review, CI validation, unit tests against real samples, staged rollout, and rollback when a rule goes bad.
Living Off the Land: Detecting LOLBins Before They Detect You
Attackers abuse trusted Windows binaries like certutil, mshta and rundll32 to stay invisible. Here is why signatures fail, how to baseline legitimate use, and how to write Sigma that separates admin work from abuse.
Hunting Cobalt Strike: Beacons, Named Pipes, and Malleable Profiles
A hands-on playbook for hunting Cobalt Strike: how Beacon works, network and named pipe signatures, malleable C2 profiles, memory indicators, ready-to-use YARA and Sigma rules, and post-detection triage.
Sigma Rules: The Complete Guide for Detection Engineers
Master Sigma from rule anatomy to SIEM conversion: logsources, field modifiers, condition logic, correlation rules and real detection examples for PowerShell abuse, LSASS access and persistence.
YARA vs Sigma: Which Detection Language for Which Job?
YARA matches bytes in files and memory. Sigma matches patterns in logs. A decision framework with side-by-side Mimikatz examples showing when to use each, and when to use both.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note