Research
Adversary-side work on how modern malware hides from the controls we rely on. Full write-ups live on the research subdomain; the sanitized case-file version is here.
The through-line is the same question in different forms: what does the adversary actually do, observed rather than assumed, and what should defenders change once they know?
The Master's research took three live malware families apart in an isolated lab and
mapped every observed behaviour to MITRE ATT&CK — including an obfuscated loader
that patches amsi.dll in memory to blind AMSI before the payload runs.
Ongoing notes cover evasion tradecraft and the detection engineering that answers it.
- Decoding Malicious Camouflage — AMSI and EDR evasion across Redline Stealer, WannaCry, and SheetRAT; 30 techniques mapped to MITRE ATT&CK.
- Threat-intelligence reports with extracted, enriched IOC sets.
- Ongoing notes on evasion tradecraft and detection engineering.