⟩ Offensive Security
ADVERSARY SIMULATION
Red Team Ops
End-to-end adversary emulation aligned to MITRE ATT&CK with custom tradecraft.
What I deliver
- Initial access, persistence, lateral movement
- C2 infrastructure design
- Evasion & EDR bypass research
⟩ real-world projects
Selected engagements
Sanitized highlights from real client work — approach, the bug we found, and the fix shipped. Names redacted under NDA.
01
30-day red team vs MSSP-monitored enterprise — domain admin in 9 days, full blue-team debrief
02
Assumed-breach engagement for SaaS — Sliver C2 over DoH, evaded CrowdStrike via DLL sideloading
⟩ common vulnerabilities & how I find them
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
01
CriticalPhishing → Initial Access
- STEP 1OSINT target users + tech stack, register look-alike domain + mail auth (SPF/DKIM/DMARC)
- STEP 2Craft pretext + payload (HTML smuggling, ISO/LNK, OAuth consent)
- STEP 3Land on beachhead, establish C2 (HTTPS + domain fronting / DoH)
- STEP 4Fix: phishing-resistant MFA, attachment detonation, user reporting button
02
HighEDR Bypass via Sideloading
- STEP 1Identify signed vulnerable binary with DLL search-order weakness
- STEP 2Build proxy DLL exporting required functions + payload loader
- STEP 3Execute via signed parent, unhook EDR userland hooks
- STEP 4Fix: signed-binary allowlisting, EDR kernel callbacks, app-control (WDAC)
03
HighLiving-off-the-Land C2 via RMM Abuse
- STEP 1Deploy or abuse an existing RMM agent (AnyDesk, ScreenConnect, Atera) as a signed C2 channel
- STEP 2Blend traffic with legitimate IT support usage to avoid network-based detection
- STEP 3Pivot to domain resources using the RMM's built-in file transfer and remote shell
- STEP 4Fix: allowlist approved RMM binaries only, alert on new/unexpected RMM installs, egress-filter unapproved vendors
⟩ arsenal
Tools & frameworks
Cobalt Strike
C2 Framework
Sliver
Open-Source C2
Mythic
C2 Framework
Havoc
C2 Framework
Empire
PowerShell C2
Covenant
.NET C2
Brute Ratel
Red Team C2
Merlin
HTTP/2 C2
Mimikatz
Credential Theft
PoshC2
Security Tool
Nighthawk
Security Tool
⟩ engage
Need red team ops expertise?
⟩ related