AI-Assisted Security Workflows
Workflows where candidate enrichment, summaries, mappings, and scores require analyst validation before use. AI accelerates mechanical steps — analysts own every decision gate.
Choose Your Review Path
Start with the path that matches what you are evaluating. Each path keeps the top story defensive and CTI-to-detection oriented.
CTI / Threat Intelligence
Detection Engineering
Malware / Reverse Engineering
Cloud / Kubernetes Security
Offensive Security / AI-Driven
Full Library
Use the full Medium navigator only after the selected paths. The homepage keeps selected work visible first so the portfolio stays scannable.
Flagship Projects
Seven top-tier projects that define the portfolio, followed by five strong supporting pieces.
Top-tier flagships
CTI Analyst Field Manual
Practitioner operating manual: evidence labels, source reliability (Admiralty A-F/1-6), confidence language, attribution methodology, infrastructure pivoting, AI controls, hunting hypotheses, detection backlog, and 10 reusable analyst templates. 80 pages, 10 modules, CI-validated.
CTI tradecraftdetection backlogtemplates
80 pages · 10 modules · DRL 0–9 model · ATT&CK mapping requires behavior evidence gate
Operation Desert Hydra
Complete CTI-to-detection pipeline on MuddyWater / Seedworm — widely reported by government and vendor sources as Iran-linked activity associated with MOIS. 71 candidate sources reviewed, 8 promoted, 10 procedure records with Observed/Reported/Assessed evidence labels, OpenCTI 6.2 knowledge graph, 11 detection records with SIEM-agnostic pseudologic, and an Ansible-provisioned Windows 10 lab validated against Kibana. 14 PASS / 1 PARTIAL / 1 FAIL across 16 rule checks. 16 of 21 ATT&CK techniques (76%) fully validated. One-command reproducible.
CTI pipelinedetection engineeringOpenCTIAI-assistedlab-validated
71 candidates → 8 promoted → 10 procedures → 21 ATT&CK techniques → 11 detections · Sysmon + Winlogbeat + Kibana · OpenCTI 6.2
Israel Government Threat Actors CTI
Sector CTI covering Iranian, Palestinian, and regional threat actors targeting Israeli government, public-sector, critical infrastructure, and adjacent suppliers. Actor profiles, ATT&CK mappings, IOC reference locations, and detection examples. Blue-team only — no binaries or exploit code.
sector CTIpublic-sourcedefensive
Handala: ASN reuse → passive DNS → crt.sh → 14 hosts · 22+ hashes · T1003.001, T1505.003, T1567.002
Customer-Driven CTI-to-Detection Methodology
End-to-end methodology for structured CTI engagements: scoping, collection, analysis, and delivery with human validation gates throughout. 15-phase cycle with AI assistance under analyst control. Three-part article series and full Docusaurus reference site.
CTI methodologydetection backlogAI-assisted
Source gate: 6 criteria — reliability · timeliness · corroboration · relevance · bias · access
OpenCTI Intelligent Shield
OpenCTI platform with a custom Claude-powered enrichment connector: Docker Compose deployment, STIX 2.1 workflows, confidence-scored IOC enrichment, and an analyst gate before any object enters the threat intelligence graph. Sanitized env example; real credentials excluded from repo.
OpenCTIplatform engineeringSTIX 2.1
Pipeline: raw feed → connector → confidence score → analyst gate → STIX object
Operation DragonRx
Full-stack APT41 pharmaceutical-sector attack simulation: Log4Shell initial access → Sliver C2 implant → Active Directory lateral movement → LSASS credential dump. Dual-layer detection with Wazuh + Zeek + Elastic. Published CTI report, lab architecture, and step-by-step attack playbook.
APT41 simulationdetection engineeringlab
CVE-2021-44228 → Sliver C2 → T1003.001 LSASS dump · Wazuh + Zeek + Elastic coverage
AIDebug
Reverse engineering walker for malware analysts: Capstone disassembly, FLIRT signature matching, CFG extraction, Frida-based dynamic tracing, INetSim isolation, 8 behavioral pattern detectors, and SIEM-ready JSON output. TUI interface — no sandbox required for static analysis passes.
Python toolmalware analysisreverse engineering
Real sample: MD5 c6ab7265… (DearStealer) · T1056.001, T1547.001, T1555.003, T1573.001 mapped
Strong supporting work
CVSS v4.0
CVSS v4.0 enrichment CLI (BTE scoring) that turns CVEs into prioritized vulnerability-management work using NVD, CISA KEV, EPSS, and configurable asset profiles. Companion Docusaurus field guide site with scoring explanations and practitioner decision frameworks.
Python CLICVSS v4.0vulnerability mgmt
StratusAI
Multi-cloud security scanner: 9 AWS modules + 7 GCP modules, 125-test suite, ECS Fargate / Cloud Run deployment. Multi-LLM finding analysis with attack-chain synthesis and severity classification in 2–4 minutes per scan.
cloud scannerAWS + GCPmulti-LLM
Android Malware Analysis
Android APK analysis toolkit: AI-powered static analysis from the terminal, OWASP Mobile Top 10 coverage, decompilation, manifest inspection, permission risk scoring, and output formatted for mobile security assessment reports.
malware analysisAndroidPython
Vulnerable AI Lab
Intentionally vulnerable AI security training lab — DVWA/WebGoat for modern AI systems. Pre-built OWASP LLM Top 10 2025 scenarios: prompt injection, RAG poisoning, tool-call manipulation, and data exfiltration via LLM agents in a realistic RAG pipeline.
LLM securityAI red teamOWASP LLM
Medium Blog Navigator
Docusaurus navigation layer for 200+ Medium articles — organized by topic, difficulty, and content cluster. Makes cross-article research and topic discovery practical at scale without relying on Medium's own recommendation engine.
Docusauruscontent navigation
Work by Domain
Start here before opening the full article library.
CTI Work
Kill chain, attribution, infrastructure pivoting, ATT&CK usage, and public-source actor research.
Detection Engineering
Threat hunting, atomic detections, correlation rules, detection backlog thinking, and telemetry coverage gap analysis.
Malware Analysis
Malware analysis tools, APK analysis, YARA-related work, file triage, import analysis, strings, and unpacking utilities.
Cloud / Kubernetes Security
Cloud-native threat research, cloud scanning, vulnerable cloud labs, audit-log thinking, and prioritization support.
AI / Workflow
AI-assisted CTI tooling, enrichment source confidence management, OpenCTI operations, and structured analyst workflows.
Offensive Security
Authorized offensive security research and adversary simulation: red-team labs, attack playbooks, and AI-assisted lab workflows used for defensive context.
Live Evidence
Real screenshots from published research — tool outputs, malware analysis, infrastructure pivots, and attack simulations. Click any image to open the source article.
Desert Hydra — det_mw_0001 (T1566.001) PASS
Kibana captures Office child process spawn; spearphishing attachment detection validated
Desert Hydra — det_mw_0010 (T1003.001) PASS
Sysmon EID 10 ProcessAccess to lsass.exe captured; credential access detection validated
Desert Hydra — OpenCTI knowledge graph
MuddyWater intrusion set: 9 malware, 4 tools, 21 ATT&CK techniques, 20 source reports
AIDebug — function analysis (TUI)
Capstone disassembly + FLIRT signature matching on real sample (MD5: c6ab7265…)
AIDebug — behavioral patterns tab
PatternDetector flags T1055.001 and T1547.001 without AI call
AIDebug — pattern detection output
8 behavioral patterns scanned per function; registry modification flagged
AIDebug — control flow graph (CFG)
Basic-block graph built per function; branch structure visible without reading ASM
AIDebug — four-panel TUI layout
Disasm · Patterns · CFG · AI tabs on a live binary; no sandbox required
CFF Explorer — PE header analysis
Import table, DOS/NT headers, sections examined on Authenticator.exe
Detect It Easy — entropy + packing scan
DIE analysis: normal entropy, no packer detected on DearStealer sample
Procmon — dynamic process trace
Authenticator.exe runs with no subprocesses and closes after 2 min (stealer behavior)
FakeNet-NG — network capture
No HTTP plaintext to malicious domain; encrypted TLS channel confirmed (T1573.001)
unpac.me — automated unpacker upload
Packed .NET sample submitted; SmartAssembly obfuscation layer identified
unpac.me — unpacked result
Nested packing layers stripped; unpacked files available for static analysis
de4dot — .NET deobfuscation
DeepSea Obfuscator layer removed; strings and control flow restored
APK Analyzer — terminal run
Four-phase analysis from a single CLI command; no sandbox required
APK Analyzer — Phase 1 (Androguard)
Permissions, intents, native libs, DEX entropy extracted via Androguard
APK Analyzer — MITRE ATT&CK mapping
CRITICAL service + T1416 OverlayActivity flagged without bytecode decompilation
APK Analyzer — YARA scan + AI analysis
Curated ruleset hits for Cerberus/Joker/FluBot families; AI remediation steps output
stratus-ai — cloud scan output
AWS + GCP attack simulation: 9+7 modules, 125-test suite, CloudTrail capture
stratus-ai — findings report
Multi-LLM severity classification and remediation output per finding
Handala — infrastructure pivot
ASN reuse → passive DNS → crt.sh → 14 additional hosts · 22 confirmed hashes
Selected Article Library
Direct Medium links only. The blog navigator is listed separately as an index resource, not used as a substitute article link.
CTI, Attribution, Pivoting
CTI Research: Kubernetes & Cloud-Native Threat Landscape
Technical kill chain analysis, detection engineering, and defensive architecture for cloud-native threats.
CTIdetectionKubernetescloudlong guide
The Intelligent Shield. OpenCTI
OpenCTI deployment, connector engineering, STIX workflows, enrichment source confidence management, and platform operations.
CTIOpenCTISTIX 2.1guide
CTI Research: MuddyWater/Seedworm
Evidence-labeled assessment, technical timeline, defensive priorities, and SOC guidance.
CTIMuddyWaterIranSOC
CTI Research: Handala Hack Group
Threat persona and cluster analysis with evidence labels, IOC handling, and defensive guidance.
CTIHandalaIsraeldetection
Infrastructure Pivoting: From One IOC to a Full Attacker Network
Field manual for passive DNS, reverse IP, ASN reuse, TLS certificates, internet search, and WHOIS pivots.
CTIautoWFOSINTguide
Attribution Methodology
How to build, defend, and challenge attribution claims without overstating the evidence.
CTIattributionconfidenceguide
ATT&CK as a Working Tool
Hands-on ATT&CK use for mapping, gap analysis, Sigma thinking, hunting, and adversary emulation.
CTIATT&CKhuntinglong guide
CTI Kill Chain: An Analyst Guide With Real-World Evidence
Kill-chain thinking for analysts who need evidence, not generic phase labels.
CTIkill chainevidenceguide
Manual CTI vs. AI-Assisted CTI
Step-by-step comparison of where AI compresses CTI work and where analyst judgment remains non-negotiable.
CTIanalyst workflowtradecraftguide
CTI Program Design
Customer-Driven AI CTI Project
End-to-end CTI-to-detection methodology and project workflow overview.
CTI programdetection engineeringgovernance
Customer-Driven AI CTI Project Template: Part 1
Foundations and methodology for a customer-driven CTI lifecycle.
methodologytemplatelong guide
Customer-Driven AI CTI Project Template: Part 2A
Phase-by-phase execution guide from requirements to hunts and detections.
executionhuntslong guide
Customer-Driven AI CTI Project Template: Part 2B
Reference toolkit for artifacts, gates, delivery materials, and validation.
referencetoolkitvalidation
Detection And Hunting
Endpoint Threat Hunting: Windows, Linux, and macOS
Telemetry, artifacts, MITRE ATT&CK tactics, and practical playbooks for endpoint hunting.
huntingendpointSOC
Protocol-Level Network Threat Hunting
Wireshark-centric guide to IOCs, protocol anomalies, C2 signals, and packet-level hunting.
huntingnetworkWireshark
Threat Hunting with the Pyramid of Pain
How to move defenders from brittle IOCs toward artifacts and TTPs that cost attackers more.
huntingCTITTPs
Single-Event Detection Rules in Cybersecurity
Atomic detection rules for SIEM, XDR, and log-based detection platforms.
detectionatomic rulesSIEM
Correlation-Based Detection Rules
Multi-event analytics, temporal logic, and behavioral detection across SIEM and XDR.
correlationSIEMXDR
The Atomic Standard
Practitioner compendium for single-event threat detection and rule design.
detectionrulesarticle
The Invisible Pipeline
Defending CI/CD systems from targeted attacks with concrete controls and detection ideas.
detectionCI/CDDevSecOps
Malware, Cloud, AI Security
Android APK Analysis Tool
AI-assisted static APK malware analysis with YARA, VirusTotal context, candidate MITRE mapping, and Frida hooks.
malwaretoolAndroid
AI-Powered Malware Debugger
AIDebug walkthrough: FLIRT, patterns, CFGs, Frida, unpacking detection, YARA, and reports.
malwareATT&CKtool
StratusAI Cloud Security Scanner
AWS and GCP scanner architecture, multi-LLM routing, Terraform deployment, and test coverage.
cloudAWSGCPAI
AI in Offensive Operations
Evidence-based research on attacker AI use, TTPs, incidents, confidence, and forecast judgments.
CTIoffensiveAI security
CVSS v4.0 Field Guide
CVSS-BTE, KEV, EPSS, environmental scoring, examples, scanner triage, and automation.
vulnerabilityCVSSEPSS
Tools And Repositories
Repositories are grouped by defender output, not by programming language.
Malware Analysis Stack
AIDebug, Android-Malware-Analysis, Static Malware Orchestrator, Unpacker, PE Import Analyzer, String Analyzer, and file triage.
malwareYARAFridaIOC
CTI Engineering
Reports, pivoting automations, detection packs, and hunting hypotheses that move intelligence into operational use.
CTIhuntingtooling
Vulnerability And Cloud
CVSS-BTE enrichment, cloud scanning, and vulnerable cloud labs for realistic prioritization and testing.
cloudCVSSAWSGCP
Guides & Docs
Docusaurus knowledge bases, field manuals, and structured references. 52+ step-by-step guides on Medium.
CTI Analyst Field Manual
Analytic judgment, evidence discipline, hunting hypotheses, and ATT&CK-mapped detection candidates.
CTIhuntingmanual
Operation Desert Hydra
End-to-end CTI-to-detection pipeline: source review gate → procedure dataset → OpenCTI knowledge graph → 11 detection records → benign lab simulation → Kibana proof screenshots. 14 PASS / 1 PARTIAL / 1 FAIL across 16 rule checks.
CTI pipelinedetection engineeringOpenCTIlab-validated
Israel Government Threat Actors CTI
Defensive CTI knowledge base for Israeli public sector, critical infrastructure, municipal, and supplier exposure.
Israel CTIpublic sectordefense
Customer-Driven AI CTI Project
End-to-end methodology for turning intelligence requirements into hunts, detections, and delivery artifacts.
CTI programdetectionsgovernance
Customer-Driven AI CTI Template
Reusable templates for requirements, hunts, detections, evidence packs, and customer delivery.
templatehuntstoolkit
CVSS v4.0 Field Guide
Practical CVSS v4.0 scoring, environmental profiles, scanner triage, and prioritization guidance.
vulnerabilityCVSSrisk
HexStrike AI Guide
Authorized AI-assisted security lab workflows used as operator-context evidence for CTI work.
offensivelabAI
Medium Blog Navigator
Separate index for browsing the full Medium library by topic, depth, and role. Article cards above use direct article links.
OpenCTI Intelligent Shield
OpenCTI operations and security-team workflows for enrichment source confidence management and threat-intelligence platform work.
OpenCTItooloperations
Lab Work
Authorized, controlled environments built to understand attacker behavior, validate detection assumptions, and practice the full attack-to-defend cycle.
Operation DragonRx
APT41 pharmaceutical-sector attack simulation. Log4Shell initial access → Sliver C2 → Active Directory lateral movement. Dual-layer detection with Wazuh + Zeek + Elastic.
CTIlabAPT41Log4Shell
Cloud & Kubernetes Labs
Vulnerable cloud infra for cloud pentest practice: GCP + AWS Terraform deployments, 25-issue Kubernetes misconfiguration lab, and IIS / SharePoint / Fluent Bit environment.
cloudlabTerraformKubernetesGCP
Active Directory Labs
Reproducible Windows / AD pentest environments: vulnerable Windows 10, full AD domain with GPOs, Kerberoasting, Pass-the-Hash, and LSASS dump paths. Manual and one-prompt Cursor AI deployments.
labWindowsActive DirectoryKerberos
Android Security Labs
Android analysis lab on Ubuntu (Androguard + Frida toolchain). Deliberately vulnerable Android app covering all OWASP Mobile Top 10 classes. Autonomous mobile PT walkthrough.
labAndroidOWASP MobileFrida
Vulnerable AI Lab
Intentionally vulnerable AI application lab — like DVWA but for modern AI: RAG assistants, tool-calling agents, LLM-powered copilots. Covers prompt injection, data exfiltration, and agent manipulation.
AI securitylabLLMRAG
Linux & Web App Labs
Vulnerable Ubuntu 24.04 server with full HexStrike pentest walkthrough. DVWA deployment automated with Ansible for reproducible web-app attack-and-detect practice.
labLinuxDVWAAnsible
About
I profile adversary behavior, map TTPs to ATT&CK-aligned detection candidates, and ship tools that automate the mechanical parts of CTI and reverse engineering work. Current role: Threat Intelligence Research Engineer at XPLG. Formerly Head of Red Team at Israel Police Cyber Defence Unit. All tooling ships with mandatory analyst review built into the workflow — AI assists with throughput, not with judgment.
Contact
Use the profiles below for code, writing, and professional contact.