Discover the latest articles published by the SUCURILABS team about CTI, DFIR, Human risk management and more.
A practical Microsoft Entra investigation workflow for suspicious MFA activity, from the first sign-in alert to correlation, persistence checks, containment, and post-compromise validation.
By Hugo Eusébio
Resetting the password is only the first step. Learn how to contain a compromised account, remove attacker persistence, investigate what happened, and safely restore access.
A short, practical checklist for revealing links and QR code destinations in email, checking whether the request makes sense, using official channels, and reporting suspicious messages.
A practical guide to tracing an email's delivery path, interpreting SPF, DKIM, DMARC, and filtering headers, and identifying the evidence that matters during phishing investigations.
Look at how attackers abuse OAuth consent, device-code flows, redirects, and post-consent mailbox access to move around traditional email defenses.
Learn how to identify spoofed emails by checking sender details, authentication signals, suspicious links, and common fraud red flags.