Work
Everything public, organized by category. All entries link to source material.
SANS courses
Courses authored and taught at SANS Institute.
Author & instructor
SANS course on planning and executing red team engagements through adversary emulation, threat intelligence, attack infrastructure, Active Directory tradecraft, and blue-team-informed reporting.
Author & instructor
SANS course on advanced purple teaming across adversary emulation, detection engineering, and threat-informed exercises in enterprise environments.
Workshops & talks
Workshops, conference talks, and hands-on training material.
Workshop author
SANS workshop on driving Empire C2 through an MCP server using natural-language workflows.
Workshop author
Hands-on workshop on building reflective loaders in C#, with source code and slide decks.
Speaker
x33fcon talk exploring creative shellcode loader techniques for offensive operations.
Co-speaker with Randy Pargman
A defender's worst nightmare becomes true — how can blue teams react when attackers have blocked all telemetry?
Speaker
BruCon talk on using D/Invoke to bypass EDR solutions through dynamic invocation techniques.
Workshop author
SANS workshop on NTLM relay attacks for internal pentests, with an accompanying gitbook walkthrough.
Speaker
SANS webcast on detecting user impersonation techniques and lateral movement in enterprise environments.
Workshop author
Hands-on workshop on Active Directory privilege escalation using Empire C2, with gitbook walkthrough.
Open-source tooling
Offensive security tools built for real operator workflows.
Creator
Fake code-signing for binaries using built-in Windows tooling. The most-starred tool in the collection.
Creator
Encrypted-zip loader that executes position-independent shellcode from memory.
Creator
PowerShell tool combining DLL cloning and signing into a practical offensive workflow.
Creator
Phishing and MFA-bypass training application, originally built for SEC565.
Creator
IaC proof of concept for deploying a minimal Active Directory lab in AWS.
Creator
Tool for stealing and duplicating handles from other processes to abuse their privileges.
Creator
AMSI bypass via hooking, disabling the Antimalware Scan Interface at runtime.
Creator
Tool for nuking Windows event logs to cover tracks during red team operations.
Creator
Backdoor implant tool for persistence during red team engagements.
Creator
Clipboard monitoring tool for capturing sensitive data during offensive operations.
Articles & posts
Technical writing on security operations, infrastructure, and offensive tradecraft.
Author
Recurring security issues observed over a decade of assessments — the problems that keep coming back.
Author
Building a notification service to alert operators when new beacons check in on Cobalt Strike.
Author
Exploring how generative AI can be used to encode malware payloads and evade endpoint detection.
Author
Techniques for spoofing parent process IDs to evade detection during offensive operations.
Author
Using an unmanaged .NET file searcher to locate sensitive files during red team engagements.
Author
Introducing a tool for mapping out attack paths and visualizing offensive operations.
Author
Walkthrough on converting SCYTHE payloads into shellcode for use in custom loaders.
Co-author with Dave Mayer
Technical case study on a privilege escalation finding involving a service that wouldn't start.
Author
In-depth guide covering modern NTLM relay attack techniques and mitigations.
Decks & material
Workshop slide decks, webcast repos, and downloadable material.
Walkthrough
Step-by-step gitbook companion to the NTLM Relaying 101 workshop.
Material hub
Public repository for current workshop and webcast material.
Slide deck
PDF deck accompanying the Buer emulation workshop.
Slide deck
PDF deck accompanying the C# reflective-loader workshop.