A skill, applied

CrowdStrike

I compared a malware sample's controlled execution with CrowdStrike-protected endpoint records to distinguish potential payload behaviour from activity observed on the client device.

Experience at Growing MSSP with Offensive Services

Growing MSSP with Offensive Services

From obfuscated PowerShell to MSBuild injection

Malware Analysis / Incident Response

I unpacked a staged loader to explain its MSBuild injection, C2 and registry persistence, then checked which behaviours had occurred on the affected endpoint.

Read the story

CrowdStrike

From obfuscated PowerShell to MSBuild injection

Viewed history

Ask about my work.