Project index
Selected work showing how I investigate problems, automate repeatable checks, validate results, and document limits for junior security operations and detection engineering roles.
A from-scratch Sigma-to-Wazuh compiler with validation gates, stable rule identity, and API deployment behind a dry run.
58 Sigma → 216 Wazuh rules
119 ATT&CK techniques, 14 tactics
87 automated tests
57 of 58 rules target Windows process creation
An approval-gated environment where identity, endpoint state, ticketing, alerts, approvals, and audit evidence run as one executable chain. Every privileged action passes a recorded policy decision.
2,092-case policy parity
90 of 108 privileged attempts denied
1,631 audit records, chain valid
Synthetic environment, not a production platform
Captures MCP tool-call traffic and turns it into evidence a human reviewer can act on: bounded detections, trust-boundary inventory, and measured blind spots.
10 rules, 5 abuse techniques
4,727-record benign corpus
12 documented evasion classes
3 of 12 evasion classes are structurally undetectable
An Authentik SSO perimeter wired to Canarytokens and a Python enrichment service, built to study high-signal identity tripwires.
Authentik + Canarytokens
Flask webhook processor
AbuseIPDB enrichment, ARM64 lab
Proof of concept, not a production identity control
A SAML sign-in failure diagnosis pipeline where a deterministic verifier establishes the facts and a grounding gate rejects any model claim the facts do not support.
55 SAML cases, 94.5% disposition accuracy
6 of 6 reachable injection payloads resisted
0 secrets across 280 recorded prompts
Keycloak only, and the AI path still trails the deterministic path
Traced a HiddenAds infection on a family device with ADB and package timelines, then reversed the APK in an isolated Kali lab. Identifiers and the sample stay redacted.
ADB + package timeline
APKTool, JADX, VirusTotal
Published write-up, Sep 2025
Common method across all six: make the logic inspectable, run it against evidence, and document what it cannot resolve.