// threat research · detection engineering · offensive testing · governance
Threat modelling for industrial control system malware
A structured framework for profiling and comparing malware that targets industrial control systems. The work builds behavioural feature profiles across a corpus of nine ICS malware families — from Stuxnet through to FrostyGoop — extracting nineteen behavioural dimensions per family and mapping observed techniques to MITRE ATT&CK for ICS.
A core component applies similarity analysis across those technique sets to surface behavioural relationships between families, threat groups, and campaigns that aren't visible from individual malware reports alone.
Things I've built and created
A hands-on SIEM deployment documenting the full pipeline: log ingestion, KQL-based detection engineering, analytics rule authoring, and incident response workflow using Microsoft Sentinel.
A web security scanner that fingerprints technologies and checks them against the OSV and NVD CVE databases to surface known vulnerabilities, with automated risk scoring.
Designed and analysed intrusion detection architecture, investigating real packet captures in Wireshark to reconstruct attack lifecycles from reconnaissance through to data exfiltration. Applied signature-based, anomaly-based, and stateful protocol analysis aligned with NIST IDPS guidance.
A Linux-based wargame teaching Identity and Access Management through hands-on exploitation — permissions, groups, capabilities, SSH keys, backups, and privilege escalation. Delivered as a live workshop at CyberNI Week 2026.
A structured cybersecurity risk register aligned with ISO 27001 and UK GDPR, applying risk scoring, prioritisation, and treatment strategies across data protection, vendor risk, and regulatory compliance.
A lightweight Bash tool that detects duplicate SSIDs advertising different BSSIDs — a common indicator of rogue access points used in Evil Twin and machine-in-the-middle attacks.
Analysis of challenges, vulnerabilities, and what defenders should take from them
A ransomware gang forgot to delete their exfil script before zipping victim data. That one mistake handed us their backend panel URL, API key, and admin credentials. Solved in under two hours. #28 of 250.
An AI agent leaked its system prompt and an internal code — not to a jailbreak, but to a question that sounded like small talk. Why every loud attack failed and the boring one worked, mapped to OWASP LLM07 and MITRE ATLAS.
Breaking XOR encryption using known plaintext attacks. Why repeating-key XOR fails when attackers know part of the message.
Nmap scanning, Gobuster enumeration, CVE exploitation, and privilege escalation via vim.
Subdomain enumeration using ffuf and SSL certificate inspection to discover hidden services.
Deep-dives into topics I'm actively researching — written in my own words
I'm a cyber security practitioner with deliberately wide interests — threat research, detection engineering, offensive testing, and governance. I'm currently completing an MSc in Applied Cyber Security at Queen's University Belfast, where my research builds a threat modelling framework for ICS malware.
Before the MSc I spent three years in security operations and governance — ISO 27001 initiatives, Microsoft Purview DLP, audit readiness, incident analysis, and stakeholder reporting across multi-regional environments. That background is why I care about whether a detection can actually be operationalised, not just whether it fires in a lab.
Alongside the research I work part-time as a security analyst doing passive reconnaissance and attack surface analysis, hunt bugs on YesWeHack and HackerOne, and write up what I find.