Purple Teamer 路 DFIR. Adversary Emulation 路 Detection Engineering
I work both sides of the fight: researching how attackers operate, then turning that tradecraft into open-source hunting queries and detections defenders can use right away.
- CB-Threat-Hunting 路 Threat hunting queries for Carbon Black
- DefenderATPQueries 路 Advanced hunting queries for Microsoft Defender for Endpoint
- Project-Lost 路 Living Off Security Tools
- awesome-email-security 路 Curated enterprise email security resources
- Sysmon 路 Sysmon configs for Windows and Linux
- WebShellsThreatGroups 路 Webshells mapped to threat groups for emulation and detection testing
Tools: Defender for Endpoint (KQL) 路 Carbon Black 路 Sysmon 路 YARA 路 Sigma 路 Velociraptor 路 C++. C#. ASP.net. Python
馃摣 LinkedIn