Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#yara
Newest first
Detection as Code: Versioning, Testing, and Shipping Your Rules
Treat your YARA and Sigma rules like software: git workflows, code review, CI validation, unit tests against real samples, staged rollout, and rollback when a rule goes bad.
Hunting Cobalt Strike: Beacons, Named Pipes, and Malleable Profiles
A hands-on playbook for hunting Cobalt Strike: how Beacon works, network and named pipe signatures, malleable C2 profiles, memory indicators, ready-to-use YARA and Sigma rules, and post-detection triage.
YARA Rules: The Complete Guide for Threat Hunters
Master YARA from zero to hero: full syntax, advanced conditions, modules, optimization and real-world examples to detect malware, ransomware and APTs. A no-nonsense technical guide.
Writing YARA Rules That Don't Melt Your Scanner
Slow YARA rules kill throughput at scale. Learn how the engine really matches with atoms, why short strings and greedy regex hurt, how condition ordering short-circuits work, and how to benchmark and fix your rules.
YARA vs Sigma: Which Detection Language for Which Job?
YARA matches bytes in files and memory. Sigma matches patterns in logs. A decision framework with side-by-side Mimikatz examples showing when to use each, and when to use both.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note