Not an expert.
Still taking it apart.
Notes on detection, cloud-native security and how attacks actually work — most of it learned the hard way.
I got into this because things that were supposed to be closed kept turning out not to be. That curiosity became a career, and these days I spend it writing detections and pulling infrastructure apart.
DetectionCloud SecurityMalwareAutomation
What I do
I work in detection engineering and cloud-native security: writing the rules that catch an intrusion, reviewing the infrastructure that invites one, and automating the parts nobody should be doing by hand.
Most of that work happens in the gap between what a technique is described as doing and what it actually does on a real system. That gap is where detections fail, and it is what I spend my time on.
Why this site exists
Writing something down is how I find out whether I understand it. If I can't explain a mechanism plainly, I haven't learned it yet — so most of what's here started as a note to myself.
The standard I hold these pieces to: they should teach you a mechanism, not summarise an event. If you finish one knowing only what happened rather than how, it failed.