Research

At the time of writing this I'm one of the top contributors at HijackLibs, an open-source project that provides a curated list of DLL hijacking candidates found abused in the wild.

Worked on multiple PaperCut application server compromises during SOC investigations where threat actors have exploited recent critical vulnerabilities to perform remote code execution on exposed servers. Full personal write-up coming soon!

Completed a write-up on UNC6692 tradecraft based on observed exploitation of SNOWBELT (a malicious Edge browser extension), providing a threat actor with C2 connection to a compromised endpoint.

Conducted a Security Operations Knowledge Share at a previous role, tracking the TTPs and impact of the Scattered Spider group, known for disrupting some of the largest UK businesses, such as Marks and Spencer, Jaguar Land Rover and Transport for London.