I do security research because I like taking things apart to see how they break, then working out how you would catch it. Most of that happens in a homelab I run - a small Windows domain wired up with Sysmon, Wazuh, and Velociraptor - where I build the attack and then the detection that catches it.
Lately that means detection engineering: RMM abuse, lateral movement, and the gap between "a tool is present" and "a tool did something." Alongside it I poke at AI red teaming and smart-contract security when a problem pulls me in. Everything gets written up in public, mistakes included.
A mix of completed projects and work in progress, covering detection engineering, security tooling, and recon automation.
Sysmon + Wazuh detection for RMM (remote monitoring and management) abuse. Identifies remote-access tools by rename-proof PE metadata, alerts when two distinct vendors appear on one host, then goes further - catching when one RMM actually launched another, and escalating when that happened as SYSTEM. Companion to a two-part write-up.
The two-OptiPlex Active Directory lab everything else runs on - a BadBlood-populated corp.local domain behind a Sysmon + Wazuh detection platform, with Velociraptor coming online next. Root repo for the individual detection projects, plus write-ups on what broke and what got exercised along the way.
PowerShell baseline and hardening scripts for the corp.local domain, organized one folder per host - domain controller health and LDAPS enforcement, member server review, workstation security audit and ASR enforcement.
Modular recon pipeline - subdomain enumeration via subfinder, live host probing with httpx, response header fingerprinting, and tech stack detection. Built for HackerOne bug bounty recon.
Categorised prompt injection payload library with a test runner for any OpenAI-compatible endpoint - direct injection, indirect via RAG context, jailbreaks, data exfil probes, and a response scoring engine.
Active work across homelab attack-defend research, HTB, and PortSwigger. Published articles on Medium covering detection engineering, AD exploitation, and offensive tooling.
Detecting daisy-chained remote access tools with Sysmon and Wazuh. Part 1 builds the rename-proof telemetry and identification; Part 2 adds the multiplicity and causal detection in the SIEM.
| Date | Platform | Target | Vuln Class | Summary | Writeup |
|---|---|---|---|---|---|
| 2026-06-28 | Homelab | WS01 - RMM Abuse Detection | T1219 · detection engineering | Sysmon + Wazuh rules that identify RMM tools by rename-proof metadata, flag two distinct vendors on one host, and catch one RMM launching another (escalating under SYSTEM) | Read → |
| 2026-04-15 | Bug Bounty | Recon tooling - recon-logger | recon · tooling · Python | Python HTTP header recon tool - flags missing security headers, outdated server fingerprints (PHP 5.x, Apache 2.2, IIS 6/7), and wildcard CORS misconfigurations | Read → |
| 2026-01-10 | Homelab | DC01 - Windows Network Share | SMB · lateral movement | Attacked overpermissioned share via smbclient; detected via Event 5145 in Splunk; hardened SMB signing and ACLs | Read → |
| 2025-12-08 | Homelab | APP01 - IIS / MySQL | Web misconfig · SQLi · priv esc | IIS directory browsing + MySQL exposed → web shell → app pool running as Domain Admin → full domain compromise | Read → |
| 2025-11-28 | Homelab | DC01 - Domain Controller Assessment | AD · password policy · NTP | PowerShell baseline assessment: excessive DA membership, zero lockout threshold, NTP misconfiguration, legacy NetBIOS exposure | Read → |
| 2025-11-28 | Homelab | APP01 - Web Server Assessment | IIS · MySQL · service accounts | HTTP without TLS, MySQL on 0.0.0.0, SMB/WinRM exposed, three overprivileged service accounts identified | Read → |
| 2025-11-27 | Homelab | WIN11-MGR1 - Workstation Assessment | Windows hardening · AD | AutoAdminLogon with DA credentials in plaintext registry, UAC disabled, RDP open, Kerberoastable service accounts - critical chain to domain compromise | Read → |
| 2025-11-20 | Homelab | cjcs.local - AD Attack Chain | AD · Kerberoasting · DCSync | Network access → CrackMapExec → Responder NTLM capture → Hashcat → Kerberoasting via impacket-GetUserSPNs → DCSync - full domain compromise documented | Read → |
| 2025-10-30 | Homelab | DC01 - AD Hardening (SOC 2) | GRC · AD · LDAPS | SOC 2 CC6.1/CC7.1/CC8.1 gap remediation - account tiering, Wazuh rule 100010 for privileged login detection, LDAPS via internal CA on port 636 | Read → |
| 2025-10-08 | Homelab | SIEM01 - Wazuh Build | SIEM · detection engineering | Wazuh 4.14.0 on Ubuntu 24.04 with agents on DC01/APP01/MGR1; custom brute force and password spray rules; MITRE ATT&CK mapped alerts | Read → |