I build evidence-first security tools for Windows identity, incident response, and authorized assessment — mostly in Rust. The work is designed to be inspectable: collect scoped signals, model the path, validate what is supported, and keep the evidence connected to the conclusion.
signal ──▶ scoped collection ──▶ control path ──▶ supported finding ──▶ report
ADhammer is an Active Directory security assessment platform built around a simple rule: evidence, not assumptions.
- Discover directory objects, policy, delegation, and trust relationships.
- Map Tier-0 control paths and explain why each edge matters.
- Validate findings only when the collected evidence supports them.
- Produce human-readable reports without separating proof from impact.
Explore: project site · source · latest release · SDK docs
| Layer | Projects | Purpose |
|---|---|---|
| Identity & crypto | kerbcore · ntlmssp · dpapi-ng |
Kerberos, NTLMSSP, and Windows protected-data foundations in pure Rust |
| Wire & RPC | smb2-client · dcerpc · ms-ndr |
Authenticated transport, Microsoft RPC, and bounded data representation |
| Windows evidence | windows-eventlog-native · windows-sddl · ad-access |
Event collection, security descriptors, and effective-access analysis |
| Native foundation | win32-min |
Focused Win32 interfaces with explicit safety contracts and ABI verification |
The libraries are intentionally small and composable. Together they form the protocol and evidence pipeline beneath higher-level assessment and defensive workflows.
| Discipline | What I optimize for |
|---|---|
| SOC & incident response | Fast triage, defensible context, and useful handoff |
| Malware analysis | Behavior-led investigation and concise reporting |
| Active Directory security | Identity relationships, privilege paths, and supported validation |
| Android / APK security | Explicitly scoped static and dynamic assessment |
ECHO is a private-by-design, cross-platform pixel-art desktop companion. It reacts to local activity, remembers between sessions, and runs without accounts or runtime telemetry. It is where I explore product design, animation systems, and local-first software.
- Scope first. Security work begins with explicit authorization and visible boundaries.
- Observed is not proved. Collection, inference, and validation stay separate.
- Small foundations. Protocol components remain focused, testable, and reusable.
- Useful evidence. Results should help both the operator and the defender make a decision.
Research map
Active Directory · Kerberos · NTLMSSP · LDAP · SMB2 · DCE/RPC ·
NDR · DPAPI-NG · Windows Event Log · security descriptors ·
SOC / IR · malware analysis · Android / APK security · Rust
Authorized research. Reproducible evidence. Transparent tooling.
Explore all repositories