https://mlab.sh Blog posts and engineering notes from mlab.sh en https://mlab.sh/engineering/laya-prompt-injection-guardrail https://mlab.sh/engineering/laya-prompt-injection-guardrail Sun, 11 Oct 2026 08:00:00 +0000 Engineering We tested Laya as a prompt-injection guardrail for the text mlab's MCP tools return: three question wordings, a training grid over three sizes and three seeds, real documentation and long pages. Where it works, why it flags 40% of real READMEs, and the numbers that would make us ship it. https://mlab.sh/engineering/replaying-supply-chain-attacks https://mlab.sh/engineering/replaying-supply-chain-attacks Sat, 10 Oct 2026 08:00:00 +0000 Engineering Eleven public npm, PyPI and crates.io incidents replayed against postmortem, then five large real projects read by hand: which signals fire before an advisory exists, why a 48-hour cooldown is the cheapest control, and the six bugs the test found in our own tool. https://mlab.sh/blog/how-to-read-a-cti-report https://mlab.sh/blog/how-to-read-a-cti-report Fri, 10 Jul 2026 09:08:17 +0000 Blog Vendor threat reports mix marketing, narrative, and actionable intelligence. A repeatable method for extracting IOCs, TTPs, and detection opportunities while filtering the noise. https://mlab.sh/blog/epss-explained https://mlab.sh/blog/epss-explained Thu, 9 Jul 2026 12:01:13 +0000 Blog EPSS gives every CVE a daily probability of exploitation in the wild. Here is what the model actually predicts, how to read scores versus percentiles, and where the number stops helping. https://mlab.sh/blog/ransomware-response-first-24-hours https://mlab.sh/blog/ransomware-response-first-24-hours Wed, 8 Jul 2026 13:43:07 +0000 Blog Ransomware response is a sequence of decisions, not a timeline. Isolate or observe, verify backups before promising recovery, scope exfiltration, and start the legal clocks on time. https://mlab.sh/blog/stix-taxii-misp-field-guide https://mlab.sh/blog/stix-taxii-misp-field-guide Thu, 2 Jul 2026 21:18:55 +0000 Blog What STIX objects, TAXII transport, and the MISP platform each actually do, where interoperability breaks in practice, and when a plain CSV is all the standard you need. https://mlab.sh/blog/sbom-vulnerability-tracking https://mlab.sh/blog/sbom-vulnerability-tracking Mon, 29 Jun 2026 16:36:08 +0000 Blog What SBOMs actually are, why regulators keep demanding them, how scanning one against a CVE database works, and where the whole approach quietly breaks. https://mlab.sh/blog/passive-dns-for-investigators https://mlab.sh/blog/passive-dns-for-investigators Mon, 29 Jun 2026 15:49:17 +0000 Blog Attackers rotate infrastructure constantly, but DNS remembers. How passive DNS is collected, how it exposes campaigns, and how to pivot from one domain to an entire operation. https://mlab.sh/blog/incident-response-first-60-minutes https://mlab.sh/blog/incident-response-first-60-minutes Sat, 27 Jun 2026 12:48:03 +0000 Blog When an alert turns real, the first hour decides the investigation. A concrete checklist for validating, scoping, preserving evidence, and avoiding the mistakes that cannot be undone. https://mlab.sh/blog/anatomy-of-a-cve https://mlab.sh/blog/anatomy-of-a-cve Wed, 24 Jun 2026 10:22:20 +0000 Blog Follow a vulnerability through its full lifecycle: discovery, coordinated disclosure, CNA assignment, NVD enrichment, publication, and exploitation, and learn what every field of a CVE entry really tells you. https://mlab.sh/blog/scanning-your-own-attack-surface https://mlab.sh/blog/scanning-your-own-attack-surface Fri, 19 Jun 2026 18:58:27 +0000 Blog Attackers scan your perimeter every day. Most organizations scan their own once a year. Here is what external recon on yourself reveals, and why continuous beats annual. https://mlab.sh/blog/from-ioc-to-adversary-attribution-basics https://mlab.sh/blog/from-ioc-to-adversary-attribution-basics Mon, 15 Jun 2026 19:55:38 +0000 Blog How analysts get from a single indicator to a named adversary: activity clustering, infrastructure overlap, malware lineage, false flags, and why defenders should care more about how than who. https://mlab.sh/blog/your-first-threat-hunt https://mlab.sh/blog/your-first-threat-hunt Fri, 12 Jun 2026 22:58:00 +0000 Blog A start-to-finish first threat hunt for beginners: pick a hypothesis, gather data, write queries, separate signal from admin noise, document findings, and turn results into a durable detection. No expensive tooling required. https://mlab.sh/blog/detection-as-code https://mlab.sh/blog/detection-as-code Sat, 6 Jun 2026 12:14:47 +0000 Blog Treat your YARA and Sigma rules like software: git workflows, code review, CI validation, unit tests against real samples, staged rollout, and rollback when a rule goes bad. https://mlab.sh/blog/alert-fatigue-design-problem https://mlab.sh/blog/alert-fatigue-design-problem Thu, 4 Jun 2026 21:20:17 +0000 Blog SOCs do not drown because they lack analysts. They drown because the alert pipeline was never designed. Here is a framework for fixing it end to end. https://mlab.sh/blog/memory-forensics-101 https://mlab.sh/blog/memory-forensics-101 Wed, 3 Jun 2026 13:35:22 +0000 Blog An accessible introduction to volatile evidence: what only exists in RAM, when to capture it, and how to start analyzing memory images with Volatility 3. https://mlab.sh/blog/nis2-dora-gdpr-untangled https://mlab.sh/blog/nis2-dora-gdpr-untangled Mon, 1 Jun 2026 09:04:30 +0000 Blog Three EU regulations, three different scopes, one confused compliance team. A clear map of who each one covers, where they overlap, and what to fix first. https://mlab.sh/blog/vulnerabilities-threat-actors-exploit https://mlab.sh/blog/vulnerabilities-threat-actors-exploit Sun, 31 May 2026 15:22:49 +0000 Blog Attackers do not exploit CVEs at random. Cross-referencing actor profiles with their known exploited vulnerabilities reveals clear patterns you can use to prioritize patching. https://mlab.sh/blog/incident-playbooks-people-follow https://mlab.sh/blog/incident-playbooks-people-follow Mon, 25 May 2026 16:39:40 +0000 Blog Most IR playbooks die in a wiki: too long, written for auditors, never exercised. Here is how to write short, decision-oriented runbooks your team will use at 3 a.m. https://mlab.sh/blog/detecting-lolbins https://mlab.sh/blog/detecting-lolbins Fri, 15 May 2026 13:23:36 +0000 Blog Attackers abuse trusted Windows binaries like certutil, mshta and rundll32 to stay invisible. Here is why signatures fail, how to baseline legitimate use, and how to write Sigma that separates admin work from abuse. https://mlab.sh/blog/regex-for-security-analysts https://mlab.sh/blog/regex-for-security-analysts Thu, 14 May 2026 22:40:31 +0000 Blog A practical regex cookbook for log analysis and IOC extraction: IPs, domains, URLs, hashes, base64 and defanged indicators, plus the mistakes that quietly break your matches. https://mlab.sh/blog/business-email-compromise https://mlab.sh/blog/business-email-compromise Fri, 8 May 2026 18:00:42 +0000 Blog BEC needs no malware, no exploit, and no payload. Just a convincing email and a wire transfer. Here is how it works, why tools miss it, and what stops it. https://mlab.sh/blog/ioc-lifecycle-aging-expiration https://mlab.sh/blog/ioc-lifecycle-aging-expiration Mon, 4 May 2026 13:14:19 +0000 Blog Indicators of compromise have a shelf life. How to score, decay, and retire IOCs before your stale blocklist starts paging on-call for legitimate CDN traffic. https://mlab.sh/blog/soc-metrics-that-matter https://mlab.sh/blog/soc-metrics-that-matter Thu, 30 Apr 2026 09:26:13 +0000 Blog Most SOC dashboards measure activity, not security. Here are the metrics that actually improve detection and response, the ones that incentivize bad behavior, and how to report both to leadership. https://mlab.sh/blog/hunting-cobalt-strike https://mlab.sh/blog/hunting-cobalt-strike Mon, 27 Apr 2026 07:10:07 +0000 Blog A hands-on playbook for hunting Cobalt Strike: how Beacon works, network and named pipe signatures, malleable C2 profiles, memory indicators, ready-to-use YARA and Sigma rules, and post-detection triage. https://mlab.sh/blog/ioc-analysis-step-by-step-complete-guide https://mlab.sh/blog/ioc-analysis-step-by-step-complete-guide Fri, 17 Apr 2026 10:04:58 +0000 Blog A complete, practitioner-focused guide to Indicator of Compromise analysis: from IP addresses and domains to file hashes and network artifacts. Includes real-world examples, tooling, automation scripts, and MITRE ATT&CK mapping. https://mlab.sh/blog/yara-rules-complete-threat-hunting-guide https://mlab.sh/blog/yara-rules-complete-threat-hunting-guide Fri, 17 Apr 2026 09:55:10 +0000 Blog Master YARA from zero to hero: full syntax, advanced conditions, modules, optimization and real-world examples to detect malware, ransomware and APTs. A no-nonsense technical guide. https://mlab.sh/blog/welcome-to-the-mlab-blog https://mlab.sh/blog/welcome-to-the-mlab-blog Wed, 15 Apr 2026 09:00:00 +0000 Blog Why we launched this blog and what you can expect: threat intelligence deep-dives, DFIR notes, product changelogs and short, actionable cybersecurity reads. https://mlab.sh/blog/cvss-epss-kev-prioritization https://mlab.sh/blog/cvss-epss-kev-prioritization Tue, 14 Apr 2026 21:38:56 +0000 Blog Patching by CVSS score alone drowns your team in criticals that will never be exploited. Here is how to combine CVSS, EPSS, and CISA KEV into a priority queue that works. https://mlab.sh/blog/whois-after-gdpr-domain-investigations https://mlab.sh/blog/whois-after-gdpr-domain-investigations Mon, 13 Apr 2026 11:30:20 +0000 Blog GDPR redacted the registrant fields investigators relied on for decades. Domain attribution still works, but the pivots have moved: RDAP, name servers, certificates, and history.