Project index
Detection engineering, security automation, MCP review, identity deception, and malware analysis.
A from-scratch Sigma-to-Wazuh compiler with validation gates, stable rule identity, and API deployment behind a dry run.
58 Sigma → 216 Wazuh rules
119 ATT&CK techniques, 14 tactics
87 automated tests
Captures MCP tool-call traffic and turns it into evidence a human reviewer can act on: bounded detections, trust-boundary inventory, and measured blind spots.
10 rules, 5 abuse techniques
4,727-record benign corpus
18 documented evasion classes
An Authentik SSO perimeter wired to Canarytokens and a Python enrichment service, built to study high-signal identity tripwires.
Authentik + Canarytokens
Flask webhook processor
AbuseIPDB enrichment, ARM64 lab
Traced a HiddenAds infection on a family device with ADB and package timelines, then reversed the APK in an isolated Kali lab. Identifiers and the sample stay redacted.
ADB + package timeline
APKTool, JADX, VirusTotal
Published write-up, Sep 2025
Common method across all four: make the logic inspectable, run it against evidence, and document what it cannot resolve.