Cybersecurity specialist · Security researcher · Rust developer
SOC & incident response · Malware analysis
Active Directory pentesting · Android / APK security testing
I work across response, analysis, and authorized assessment. The goal is to turn a security signal into defensible context — whether the work begins in a SOC queue, a malware sample, a Windows domain, or a mobile application.
- ADhammer — evidence-first Active Directory assessment: collect scoped signal, map Tier-0 control paths, and keep supported proof connected to the report. Project site · Latest release
- windows-eventlog-native — query Windows Event Logs and parse structured events for investigation and detection engineering. API docs
- windows-sddl — inspect Windows security descriptors, ACLs, ACEs, and SIDs for access analysis. API docs
- dcerpc — DCE/RPC transports and Microsoft protocol interfaces in Rust. API docs
- smb2-client — an async Rust SMB2 client for authenticated transport and file operations. API docs
- win32-min — a focused Win32 foundation with documented safety contracts and ABI verification. Ecosystem guide
Start with NTLM authentication, NDR serialization, or the ADhammer SDK. Check each package's documented maturity and supported scope before integrating it.
SDK documentation · All repositories
Open the research map
- SOC & incident response — triage, investigation, monitoring, log analysis, incident reporting, and evidence-led defensive decisions.
- Malware analysis — sample triage, behavior analysis, indicators, and reporting that helps response teams make informed choices.
- Windows identity & AD assessment — Active Directory, Kerberos, NTLMSSP, LDAP, SMB, DCE/RPC, NDR, DPAPI-NG, WinRM, and CredSSP in authorized scopes.
- Mobile and web assessment — Android / APK and web security testing as separate, explicitly scoped disciplines.
- Detection and controls — SIEM-oriented handoff, Sigma/YARA research, and EDR/DLP awareness. These are defensive ecosystems, not claims about one tool.
- Engineering — pure Rust protocol implementation, authentication protocol work, safe binary parsing, and reproducible open-source tooling.
- Make the scope visible before an assessment starts.
- Treat an observed condition and a proved condition as different things.
- Build tools that are inspectable, reproducible, and useful to defenders.
Security research and assessment work is for systems I own or am explicitly authorized to test. The goal is transparent validation and stronger defensive decisions.