BlogBlog

A 2009 BlackBerry became my clearest teacher for cellular security: the GSM stack, SIM authentication, the one-way trust that enables IMSI catchers, and what 3G/4G/5G fixed.

Prompt injection is not a bug you patch, it is a property of how LLMs are built. What I learned building Aegis to test guardrails against the OWASP LLM Top 10, and how to defend in depth.

A single misconfigured certificate template can hand a low-privileged user a path to domain admin. A purple-team walk through ESC1 and ESC8, with the events and fixes that close them.

How I triage a suspicious Android app in minutes without detonating it: reading the manifest, signer, DEX, and native libs with androguard and LIEF, then turning the judgment into YARA rules.

In AWS, the path from low-privileged to admin is usually a feature used as intended. The IAM privesc methods I check first, why they chain, and how I model and detect them with Domino.

Deep dive into advanced evasion tactics from the OSEP certification: sandbox detection, ETW/AMSI patching, living-off-the-land, and polyglot payloads.

CRTE advanced techniques: forging golden tickets in multi-forest environments, chaining privilege escalation, and evading modern detection frameworks.

Building detection pipelines on AWS: normalizing CloudTrail, GuardDuty, and Security Hub; writing effective correlation rules; and detecting privilege escalation paths.

Real incident response walkthrough: how I identified, contained, and eliminated a cryptojacking attack with live C2 exfiltration. Tools, detections, and lessons learned.