Labs
Experiments, proof-of-concepts, and technical research. Builds and findings from my own lab, written up as they happened.
Inside the Modern Malware Stack
Research into a live fileless info-stealer campaign: how a PowerShell dropper, trusted interpreters, and a multi-function C2 combine into a modular platform that never touches disk, and where detection still has purchase.
Threat-Enriched Log Pipeline
A modular Python pipeline that pulls logs from SQL Server, enriches every IP with VirusTotal and internal frequency context, and forwards the result to a SIEM over syslog.
Differential Triage for Windows Incident Response
A PowerShell collector and a Python merge script that diff a suspect Windows host against a known-good baseline, cutting the artifacts an analyst has to review by roughly 90 percent. No EDR, no licence, no coding required to run it.
Reduce and Refine: Regex-Driven Log Extraction
A short regex and Python exercise that turned an hour of manually pulling unique IPs out of IIS logs into a couple of seconds, and became the template for a lot of later automation.