Back to portfolio
⟩ Blue Team Operations
PROACTIVE DETECTION

Threat Hunting

Hypothesis-driven hunts using behavioral analytics.

What I deliver

  • MITRE-aligned hypotheses
  • Custom detection engineering
  • Telemetry gap analysis
⟩ real-world projects

Selected engagements

Sanitized highlights from real client work — approach, the bug we found, and the fix shipped. Names redacted under NDA.

01

Quarterly hunts for fintech — surfaced 3 living-off-the-land persistence mechanisms missed by EDR

02

Cloud-native hunt on AWS GuardDuty + CloudTrail — caught dormant compromised IAM key

⟩ common vulnerabilities & how I find them

Top bugs I hunt — and the steps

The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.

01

Beaconing C2 (low-and-slow)

High
  1. STEP 1Aggregate proxy/firewall logs by dst + compute inter-arrival jitter
  2. STEP 2Filter known-good, isolate periodic callbacks with low variance
  3. STEP 3Pivot to host telemetry for parent process + signer
  4. STEP 4Promote to Sigma rule + IOC list for SIEM
02

Compromised Cloud IAM Key

Critical
  1. STEP 1Baseline normal API calls per key in CloudTrail
  2. STEP 2Hunt anomalous regions, new services, recon APIs (Describe*, List*)
  3. STEP 3Correlate with source IP ASN + UA changes
  4. STEP 4Rotate keys, scope down policies, enable GuardDuty + Access Analyzer
03

DNS Tunneling / Covert Exfil Channel

High
  1. STEP 1Baseline DNS query volume, entropy and record-type distribution per host
  2. STEP 2Flag hosts with high-entropy subdomains, unusual TXT/NULL record volume, or long-tail rare domains
  3. STEP 3Pivot to the querying process and correlate with EDR process-creation telemetry
  4. STEP 4Promote to a Sigma/Zeek detection; block and sinkhole confirmed tunneling domains
⟩ arsenal

Tools & frameworks

Splunk
SIEM Platform
Elastic
Log Analytics
Sigma
Detection Rules
Zeek
Network Monitor
Suricata
IDS/IPS
Osquery
Endpoint Visibility
Velociraptor
DFIR Platform
Kestrel
Security Tool
Jupyter
Security Tool
⟩ engage

Need threat hunting expertise?

Get in touch
⟩ related

More in Blue Team Operations

Incident Response
Containment, eradication and recovery for active breaches.
SIEM Engineering
Designed scalable log pipelines and high-fidelity detections.
Purple Team Exercises
Runs red and blue side by side, technique by technique, so every gap turns into a shipped detection the same week.