Skip to content
H4vox
0/12

The story so far

From reading Windows internals to building the tools on both sides of the fight.

  1. 01: Windows internals, Foundations. Self-taught from how Windows behaves underneath the documented API surface.
  2. 02: Malware analysis, Reverse engineering. Taking real samples apart until each technique stops being magic.
  3. 03: DynLoader, Offensive tooling. Indirect syscalls, manual mapping and API hashing, built for EDR-evasion research.
  4. 04: PlanqX EDR, Endpoint defense. Building the other side: API hooking, ELAM and ETW telemetry.
  5. 05: Detection engineering, YARA, YARA-L, KQL. Rules, log pipelines and hunting across Google SecOps, Sentinel and Elastic.
  6. 06: Identity and cloud, Azure, AD, Atlas CSPM. Identity-side simulation and cloud posture tooling.
  7. Now: Agentic SOC, Now. IaC and AI-assisted automation, with agents inside the SOC loop.

Campaign log

  1. 01

    Windows internals

    Foundations

    Self-taught from how Windows behaves underneath the documented API surface.

  2. 02

    Malware analysis

    Reverse engineering

    Taking real samples apart until each technique stops being magic.

  3. 03

    DynLoader

    Offensive tooling

    Indirect syscalls, manual mapping and API hashing, built for EDR-evasion research.

  4. 04

    PlanqX EDR

    Endpoint defense

    Building the other side: API hooking, ELAM and ETW telemetry.

  5. 05

    Detection engineering

    YARA, YARA-L, KQL

    Rules, log pipelines and hunting across Google SecOps, Sentinel and Elastic.

  6. 06

    Identity and cloud

    Azure, AD, Atlas CSPM

    Identity-side simulation and cloud posture tooling.

  7. Now

    Agentic SOC

    Now

    IaC and AI-assisted automation, with agents inside the SOC loop.

Read the operator file