hello, world
Why this site exists, what I plan to write here, and how the whole thing ships.
Blue team engineering, threat intel, and the automation turning point.
I defend networks for a living — detection engineering, CTI, and the operational glue between tools. Automation is changing what a small defensive team can do, and I'm writing down what actually works.
# tip: press ` anywhere — this site has a console # tip: tap `console in the header — this site has a shell
~/writing view all →
~/attack-map what the writing covers
recon
res-dev
init
exec
persist
privesc
evasion
creds
disco
lateral
collect
c2
exfil
impact
0/76 techniques
covered · lit cells link to the writing
# tag posts with techniques: ['T1566'] frontmatter to
light the map
~/projects view all →
detect/
detection-notes wip
Public detection engineering notes: rules and hunting queries mapped to ATT&CK, with the false-positive war stories included.
intel/
cti-lab active
Self-hosted threat intelligence stack — OpenCTI, MISP, and the collection pipelines that feed them.
automate/
glue active
Automation patterns for SOC workflows: enrichment, triage, and the boring plumbing that gives analysts their hours back.
~/signals newest known-exploited vulns
CVE-2026-76461CiscoSecure Email Gateway — Cisco Secure Email Gateway SQL Injection Vulnerability
CVE-2026-84869ConnectWiseScreenConnect — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
CVE-2026-42016JFrogArtifactory — JFrog Artifactory Incorrect Authorization Vulnerability
CVE-2026-42018JFrogArtifactory — JFrog Artifactory Improper Authentication Vulnerability
CVE-2026-85706GitLabCommunity Edition and Enterprise Edition — GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
CVE-2026-86060MikroTikRouterOS — MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability