What I Do & Focus On
Digital Forensics (DFIR)
Carving network traffic (tshark/Wireshark), identifying covert channels (DNS/TCP checksum exfil), Windows Event Logs (winevt), Volatility memory dumps, and registry artifacts.
Threat Hunting & Detection
Authoring detection rules (Sigma, YARA), mapping adversary behaviors to MITRE ATT&CK, filtering endpoint telemetry via Sysmon (Event ID 1, 7, 8, 10), and dissecting C2 communications.
Malware Reverse Engineering
Static & dynamic analysis of loaders, unpacking multi-stage payloads, reversing obfuscated .NET / C++ executables (IDA Pro, Ghidra, dnSpy, x64dbg), and defeating anti-debug / anti-VM checks.
Red-Blue Synergy & CTF Authoring
Crafting realistic forensic and reversing challenge scenarios (HISC Freshman 2026), simulating adversary tradecraft (DLL sideloading, encrypted C2 beacons), and building blue-team defenses.
Featured Writeups & Research
HWH #1 - DLL Sideloading
Deconstructing malicious DLL proxying via signed binaries, carving XOR/RC4 encrypted payloads, dynamic API resolution via PEB walking, and payload staging in memory.
HISC Freshman 2026 - Journal
Authored real-world forensic challenges: Log-man (Next.js React2Shell CVE-2025-55182), 'Check'Drill (3-stage loader with Python memory injection), and HungryGuy (Ransomware with AES-256-GCM + RSA-OAEP & Discord C2).
CSCV 2025 Quals - Journal
Extracted AES-encrypted DNS exfiltration, dumped Windows Event Logs (winevt) to reverse Stealer JaNai Discord C2, retrieved BitLocker recovery key from GPT app cache, and carved TCP checksum steganography.
VSL CTF 2026 - Journal
Disk forensics triage with FTK Imager, network packet carving in Wireshark, identifying process memory injection routines, and reversing IDA Pro challenge targets.
HolaCTF 2025 - Journal
Detailed breakdown of multi-stage PowerShell payload deobfuscation, network traffic packet analysis with Wireshark, and IDA Pro binary inspection to evade detections.
WannaGame Championship 2025 - Journal
Hard-level championship triage: dissecting heavily obfuscated PowerShell execution, event log timeline reconstruction, and extracting encoded payloads.
HTB Operation Blackout: Cyber Skills Benchmark
Threat hunting on enterprise network PCAPs, dissecting multi-stage web attack vectors, Cobalt Strike beacon activity, and carving encrypted C2 transmissions.
HTB Cyber Apocalypse: Tales from Eldoria
Deep triage of Windows memory dumps via Volatility, .NET decompilation with dnSpy, and extraction of in-memory injected shellcode.
Featured Project
Flagship autonomous malware analysis and agentic triage system.
HyperAgent
Flagship Project • Agentic DFIRAn end-to-end automated malware analysis pipeline driven by autonomous LLM agent loops. Point it at an untrusted sample, and HyperAgent coordinates a deterministic, multi-stage triage — from sandbox environment health checks and IDA Pro static decompilation to x64dbg unpacking, dynamic VMware execution, VirusTotal correlation, cross-stage reasoning, and structured verdict reporting.
Tools & Arsenal
Competitions & Track Record
| Event / Milestone | Role | Key Domain / Contribution | Date |
|---|---|---|---|
| HISC Freshman 2026 | Challenge Author | Authored 3 forensic & malware reversing scenarios: Log-man, 'Check'Drill, HungryGuy | 2026 |
| CSCV 2025 Quals | Competitor | Comprehensive forensics & reversing writeups: DNS exfiltration, Discord C2, BitLocker key extraction | 2025 |
| SVATTT / Student InfoSec | Competitor | Incident triage, packet inspection, and reverse engineering challenge clears | 2024 - 2025 |
| Internal SOC Drills & Blue Lab | Researcher | Detection engineering with Sysmon & Sigma; analyzing evasion mechanics (DLL sideloading, thread injection) | Ongoing |