Skip to content
View JoseMariaMicoli's full-sized avatar
🏠
Working from home
🏠
Working from home
25 followers · 111 following

Block or report JoseMariaMicoli

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don't include any personal information such as legal names or email addresses. Markdown supported. This note will be visible to only you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
JoseMariaMicoli/README.md

🛡️ [xoce@darkarch]:~# José María Micoli

Senior Red Team Operator | Offensive Security R&D Engineer | Tradecraft Developer

"Security is a process of constant R&D. The adversary is always building; we must build faster."

I specialize in Research-Driven Adversary Emulation, simulating sophisticated threat actor behaviors by developing proprietary tradecraft to bypass modern EDR/AV and Next-Gen Firewall solutions. My work focuses on the engineering of stealthy persistence, custom C2 architectures, and the exploitation of modern attack surfaces (OIDC/CI-CD/APIs).

🛠️ FEATURED TRADECRAFT (R&D)

Project Focus Area Core Stack
Hydra-Worm Next-Gen Breach & Lateral Movement Simulation Go Rust
Hydra-C2 Modular C2 Framework with Evasion-first listeners Rust Python Kotlin
VaporTrace Surgical API Exploitation (OWASP API Top 10: 2023) Go
Ghost-Pipeline CI/CD Post-Exploitation & OIDC Trust Hijacking Python Go
APEX-PRO High-fidelity Ransomware Emulation (IR Readiness) C# PowerShell
Log4Shell-PoC High-Fidelity JNDI Exploitation & Evasion Audit Java Python
VectorVue NIST-aligned Red Team Reporting Engine Python

📊 ADVANCED ADVERSARIAL TTP MAPPING (MITRE ATT&CK®)

My research is engineered to bridge the gap between exploitation and actionable defense, cross-referenced with the NIST SP 800-61 R3 lifecycle.

Tactic Technique ID Tradecraft Implementation
Reconnaissance Active Scanning T1595.002 VaporTrace: Shadow API discovery & recursive endpoint fuzzing.
Initial Access Supply Chain Compromise T1195.002 Ghost-Pipeline: Poisoning CI/CD runners via workflow injection.
Initial Access Exploit Public-Facing App T1190 Log4Shell-PoC: JNDI/LDAP injection vectors for RCE audit.
Persistence Server Software Component T1505.003 Ghost-Pipeline: Hijacking OIDC trust for credential-less access.
Privilege Escalation Abuse Elevation Control T1548 VaporTrace: BFLA exploitation for API token scope upgrade.
Defense Evasion Obfuscated Files/Info T1027 Hydra-C2: Direct Syscalls & polymorphic payload wrapping.
Defense Evasion Indicator Removal T1070 Hydra-Worm: Automated log cleaning & Timestomping.
Discovery Network Service Scanning T1046 Hydra-Worm: Low-noise ARP/SYN scanning for internal mapping.
Lateral Movement Remote Services T1021.002 Hydra-Worm: Automated propagation via Pass-the-Ticket (PtT).
Command & Control Application Layer Protocol T1071.001 Hydra-C2: NHPP-based jitter (DNS/Webhooks) to break pattern analysis.
Impact Data Encrypted T1486 APEX-PRO: Testing backup integrity against AES-256 simulation.

⚙️ TECHNICAL ECOSYSTEM

  • Offensive Engineering: Custom C2 Development, EDR/AV Evasion (Direct Syscalls), Binary Analysis, Reverse Engineering (Ghidra/JADX), Android Native Analysis.
  • Target Landscapes: Active Directory (On-prem/Azure), Cloud Native (AWS/GCP/Azure), Microservices (REST/GraphQL), Mobile Security.
  • Infrastructure Mastery: Sophos/Fortinet/Cisco NGFW, Linux Kernel Hardening, OIDC/OAuth2 Trust Models, CI/CD Security.

🌐 INTEL & CONNECTIVITY

Pinned Loading

  1. APEX-PRO APEX-PRO Public

    APEX-PRO: Ransomware Emulation Framework - Adversary Emulation and Purple Team Framework

    Python

  2. Hydra-C2 Hydra-C2 Public

    Project Hydra-C2 is a multi-headed C2 (Command and Control) framework

    Kotlin

  3. VectorVue VectorVue Public

    Red Team & Penetration Testing Reporting Framework

    Python 1

  4. VaporTrace VaporTrace Public

    VaporTrace is a high-performance Red Team framework engineered in Go for surgical reconnaissance and exploitation of API architectures. It specializes in uncovering "Shadow APIs," analyzing authori…

    Go

  5. Hydra-Worm Hydra-Worm Public

    Hydra-Worm is a next-generation, research-oriented breach simulation framework. It utilizes a Rust-based Agent for low-level stealth and memory safety, and a Go-based Orchestrator for high-concurre…

    Go 1

  6. Ghost-Pipeline Ghost-Pipeline Public

    Ghost Pipeline is a research-focused framework designed to demonstrate vulnerabilities in modern CI/CD (Continuous Integration / Continuous Deployment) environments.

    Python