Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#threat-hunting
Newest first
Your First Threat Hunt: A Hypothesis-Driven Walkthrough
A start-to-finish first threat hunt for beginners: pick a hypothesis, gather data, write queries, separate signal from admin noise, document findings, and turn results into a durable detection. No expensive tooling required.
IOC Analysis Step-by-Step: A Complete Guide for Threat Hunters
A complete, practitioner-focused guide to Indicator of Compromise analysis: from IP addresses and domains to file hashes and network artifacts. Includes real-world examples, tooling, automation scripts, and MITRE ATT&CK mapping.
YARA Rules: The Complete Guide for Threat Hunters
Master YARA from zero to hero: full syntax, advanced conditions, modules, optimization and real-world examples to detect malware, ransomware and APTs. A no-nonsense technical guide.
Sigma Rules: The Complete Guide for Detection Engineers
Master Sigma from rule anatomy to SIEM conversion: logsources, field modifiers, condition logic, correlation rules and real detection examples for PowerShell abuse, LSASS access and persistence.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note