01 / PROFILE

0xv1n

Detection Hunting Research

Understanding adversary tradecraft.
Building detections that matter.

CREDENTIALS

OSCPCRTOCARTP

ELSEWHERE

GitHub LinkedIn X / Twitter

OUTPUT

TOOLS & RESEARCH

SELECTED PROJECTGO / macOS

DETECTION VALIDATION

MacNoise

A macOS telemetry generator for exploring and testing detection coverage.

View repository Read the writeup

LOLGlobsA catalog of glob-based command obfuscation. RemoteSessionEnumSession enumeration through undocumented Windows APIs. proc-suspendProcess suspension tooling in PowerShell.

All repositories

EXPERIENCE

FIELD RECORD

Principal Detection EngineerReliaQuest

Purple TeamOCSFAI Tooling

Threat research, adversary emulation, red/purple teaming, and application security testing. Led OCSF standardization for over 200 telemetry sources and designed enterprise detection-as-code pipelines. Building detection validation tooling and autonomous red teaming with an AI-first focus.

ReliaQuest

Detection Engineer IIIRed Canary

RubyAutomationDetection-as-Code

Standardized taxonomy for over 5,000 detection analytics. Co-presented with MITRE and Unit 42 on RMM abuse. Automated response playbooks in Ruby and Go, and contributed Atomic Red Team tests and Sigma rules.

Red Canary

Threat HunterReliaQuest

PythonSIEMEDR

Threat hunting and intrusion response for Fortune 100-1000 clients. Led proactive hunt campaigns, executive incident reporting, and customer training across SIEM and EDR technologies. Mentored junior analysts through individual feedback and organization-wide lunch and learns.

ReliaQuest

TRANSMISSIONS

RESEARCH LOG

2026.02.26Introducing MacNoise! 2024.07.14Remote Session Enumeration via Undocumented Windows APIs 2023.08.22Kernel Drivers, Process Protection, and ...Bears?

Open the archive