Security engineer and systems operator focused on detection engineering, incident response, DFIR, threat hunting, security automation, and resilient self-hosted infrastructure.
I build evidence-driven workflows: controlled execution, observable telemetry, tested analytics, bounded automation, cleanup, and public-safe documentation.
One validated lifecycle connects the flagship repositories:
- cybersecurity-playbook — canonical Sigma rules, positive/negative fixtures, generated queries, investigations, and hash-verifiable validation packs.
- DetLab-DAC — bounded multi-backend Sigma conversion, comparison, provenance, and export.
- mayuri-purple-team-lab — sanitized Proxmox lab architecture and live-validation evidence.
- mell0wx.tech — recruiter-facing case studies that preserve evidence and limitation boundaries.
Start with the Validated PowerShell Detection Lifecycle v1: one controlled PowerShell behavior traced through telemetry, Sigma, four positive fixtures, five negative fixtures, generated Splunk/Elastic artifacts, and a sanitized investigation-case result.
X32/M32 RouteView v1.0.0 turns complex Behringer X32 and Midas M32 scene routing into a reviewable operational view for troubleshooting and volunteer handoff.
- detections backed by positive, negative, and live evidence;
- ATT&CK mapping that reflects tested behavior rather than slideware;
- automation with explicit bounds, rollback, and truthful failure states;
- public artifacts that prove the work without exposing operational secrets;
- infrastructure changes that are staged, reversible, and validated after deployment.
- Website: mell0wx.tech
- GitHub: @egrexsec