Writing
Articles and engineering reports with methods, assumptions, and limitations included.
Isolating an adware-infected Android device, identifying the package through ADB and install timestamps, reversing the APK with APKTool and JADX, and correlating indicators through VirusTotal and OSINT. Identifiers and the sample stay redacted.
What Chromium's Simple Cache preserves after history is cleared: entry streams, HTTP metadata, and compressed content, plus a Python workflow that extracts, hashes, and reports findings as JSON or TSV.
A stage-by-stage trace of one shipped rule: pySigma parsing, AST traversal, field mapping, DNF distribution, De Morgan handling, lookahead merging, and stable ID assignment.
A sample deliverable for a fictional organization: observed MCP servers, trust boundaries, findings, detection coverage, and blind spots, written for a human reviewer. The environment and events are synthetic and labeled as such.
Approach
I separate tool output from interpretation, name what was observed, and say when the evidence cannot support attribution or a broader claim. If you cannot audit the reasoning, it is not a finding.