Cybersecurity specialist across offensive research and defensive response.
SOC & incident response · malware analysis · authorized Active Directory pentesting · Android / APK security testing
I work across response, analysis, and authorized assessment. The goal is to turn a security signal into defensible context — whether the work begins in a SOC queue, a malware sample, a Windows domain, or a mobile application.
- ADhammer — evidence-first Active Directory assessment: collect scoped signal, map Tier-0 control paths, and keep supported proof connected to the report. Project site · Latest release
- dcerpc — Rust DCE/RPC protocol work.
- ntlmssp — NTLMSSP / NTLMv2 protocol work.
- ms-ndr — safe NDR parsing work.
Open the research map
- SOC & incident response — triage, investigation, monitoring, log analysis, incident reporting, and evidence-led defensive decisions.
- Malware analysis — sample triage, behavior analysis, indicators, and reporting that helps response teams make informed choices.
- Windows identity & AD assessment — Active Directory, Kerberos, NTLMSSP, LDAP, SMB, DCE/RPC, NDR, DPAPI-NG, WinRM, and CredSSP in authorized scopes.
- Mobile and web assessment — Android / APK and web security testing as separate, explicitly scoped disciplines.
- Detection and controls — SIEM-oriented handoff, Sigma/YARA research, and EDR/DLP awareness. These are defensive ecosystems, not claims about one tool.
- Engineering — pure Rust protocol implementation, authentication protocol work, safe binary parsing, and reproducible open-source tooling.
- Make the scope visible before an assessment starts.
- Treat an observed condition and a proved condition as different things.
- Build tools that are inspectable, reproducible, and useful to defenders.
Security research and assessment work is for systems I own or am explicitly authorized to test. The goal is transparent validation and stronger defensive decisions.