projects

Python toolkit for automated C2 infrastructure discovery using passive DNS, JARM TLS fingerprinting, and certificate transparency logs. Supports Cobalt Strike, Sliver, and Brute Ratel detection heuristics.

Curated collection of YARA detection rules for common malware families including Emotet, QakBot, IcedID, and various RATs. Organized by threat actor and malware type, with test samples and validation scripts.

Collection of Sigma detection rules targeting post-exploitation techniques, AD attacks, and living-off-the-land binaries (LOLBins). Tested against Splunk and Elastic backends.

Lightweight tool for baselining internal DNS traffic and flagging anomalies — DGA-like domains, high-entropy subdomains, and newly registered domains. Designed to run on top of Zeek logs.

Personal knowledge base of CTF techniques, exploit patterns, and tooling one-liners organized by category: pwn, web, crypto, forensics, and AD/Windows.

Automated IOC extraction and enrichment pipeline. Pulls indicators from threat reports, enriches via VirusTotal and Shodan APIs, and exports to MISP or CSV.