Subject: h4vox. Ordered dither, 8 colours.
I'm Havox.
I'm Havox. I work on the offensive side of security so the defensive side gets better evidence. Most of my time goes into Windows: how it behaves underneath the documented API surface, what endpoint products can and cannot see, and what that means for the people writing detections.
I started with Windows internals and malware analysis, taking real samples apart until each technique stopped being magic. That turned into reverse engineering, then into building my own research tooling, because the fastest way to understand a defense is to build something that has to get past it in a lab.
The same curiosity runs the other way. PlanqX, my EDR project, exists because building the sensor teaches you what the sensor misses. Detection work across Google SecOps, Microsoft Sentinel and the Elastic Stack keeps me honest about what actually fires in production.
The loop I care about: emulate an adversary, measure what the defenses noticed, write down the gaps, and turn each one into a rule, a hunt or a fix. Red team is a mirror. It only helps if someone looks into it.
How I work
Assume breach
Plan for the attacker who is already inside. Prevention buys time; detection and response decide the outcome.
Emulate, then measure
A technique run in the lab is only half the work. The other half is the record of what fired, what didn't, and why.
Hand back the evidence
Every gap leaves my lab as something a defender can use: a detection, a hunt query, or a clear fix.
Stay in scope
Authorized labs and agreed engagements only. Trust is the one thing a red teamer can't patch.
Operator file
- Handle
- h4vox
- Role
- Offensive security researcher, adversary simulation
- Specialty
- Windows internals, custom tooling, EDR research
- Ops
- Adversary emulation, red and purple team
- Defends with
- YARA, YARA-L, KQL, Sigma
- Clearance
- Authorized targets only
- Status
- Open to research collaboration
Loadout
Tools that show up in the daily loop, on both sides.
- C / C++
- C#
- Python
- PowerShell
- Assembly (x64)
- Cobalt Strike
- Sliver
- Havoc
- Custom loaders
- MITRE ATT&CK
- YARA / YARA-L
- KQL
- Sigma
- Velociraptor
- Sysmon / ETW
- Google SecOps
- Microsoft Sentinel
- Elastic
- Azure / AD
- Windows
- Adversary Emulation / Simulation
- Threat Hunting
- Detection Engineering (YARA / YARA-L / KQL)
- Reverse Engineering
- Windows Internals
- Exploit Development Research
- Custom Tooling & Loaders
- EDR: implementation, review, testing
- SIEM: Google SecOps, Sentinel, Elastic
- Log pipelines & endpoint telemetry
- Azure / Active Directory
- IaC + AI-assisted automation
- Agentic SOC experiments
Want the long version?
The campaign log has every stage. The contact page has every channel.