I hunt adversaries. I stop threats.

Threat hunting and incident handling. I dig through raw telemetry to find what automated tools miss and handle incidents from triage to resolution. I'm a Threat Hunter at Secnap Network Security.

About Me My Hunts

EDR Platforms Hunted

Custom Detections

Certifications

What I Do

Threat Hunting & Incident Handling

Threat Hunting

Hypothesis-driven hunts across endpoint, cloud, and identity environments. Digging through raw EDR telemetry to surface threats that automated tools don't catch.

Incident Handling

Triage, investigation, containment, and escalation. Working incidents from first alert to resolution, including direct customer communication during declared incidents.

SOC Operations

Built the SOC dashboard, workflow system, and response processes from the ground up. Keeping the operation running and making it better every day.

Highlights

Things I've Actually Found

Secnap

ClickFix Attack via Callstack Analysis

Caught a ClickFix attack through callstack analysis. Explorer.exe with shell32.dll was spawning untrusted processes. Stopped it before NetSupport RAT could deploy.

Red Canary

2-Month VPN Compromise

Found a threat actor sitting in a customer's VPN for two months, undetected, running AD brute force. Built a recurring hunt to cover the gap.

View All Hunts

Tools

What I Work With

LimaCharlie CrowdStrike SentinelOne Microsoft Defender Carbon Black Palo Alto Cortex Wazuh Velociraptor Fibratus (ETW) Sigma Rules MITRE ATT&CK Azure Entra ID Active Directory Jupyter / Pandas PowerShell Linux