I build Windows software and security tooling, and I work as an incident responder.
Most of what is here falls into two halves that keep feeding each other. On one side, shipped products: desktop applications people install, review and complain about, distributed through the Microsoft Store, winget and the usual software catalogues. On the other, security engineering: detection rules, forensic tooling and incident write-ups, each built to be run and checked rather than read and believed.
Working both sides changes how you build. Handling alerts for a living teaches you what an attacker actually does before your product's threat model is finished, and shipping to strangers teaches you that a control nobody can understand is a control nobody uses.
|
Windows performance, gaming, privacy and maintenance tuning where every change is snapshotted before it is applied, so any tweak can be reversed.
Microsoft Store · Softpedia review 4.5/5 · MajorGeeks 5.0/5 |
Website security scanning for agencies. No scan runs against a domain whose ownership has not been proved, and the proof is rechecked when the scan executes, not when it is queued.
|
|
Catches secrets, credentials and personal data in text before it is pasted into ChatGPT, Claude, Gemini or Copilot. Detection runs locally. Desktop app, browser extension and web version |
Local-first analytics for YouTube, Instagram, TikTok and X. Credentials and history stay on the machine; nothing is relayed through a server of mine. |
Each of these is a working tool with its own test suite, not a write-up of something that was done once. Detection logic is validated against samples that should fire and samples that should not, and the validation runs in CI.
| Project | What it does |
|---|---|
| detection-engineering-rules | YARA and Sigma rules, each checked against true and false positive cases. Sigma is compiled to real Splunk SPL with pySigma rather than validated as YAML. |
| network-traffic-analysis | Scapy PCAP analyser for port scans, C2 beaconing and floods. A statistical baseline catches slow floods that fixed thresholds structurally cannot, with a side-by-side demo showing the difference. |
| malware-triage-hash | Hash reputation joined to behavioural scoring, so an unknown sample is not read as a clean one. Ships a Sentinel KQL hunt. |
| ransomware-dfir-timeline | Process, Prefetch, Registry and filesystem artifacts correlated into a single timeline, from the opened attachment to mass encryption, with root cause and detection gaps. |
| phishing-email-analysis | Parses raw .eml, extracts headers, URLs and attachment hashes, flags typosquatting and urgency patterns, enriches through VirusTotal. |
| splunk-brute-force-detection | SPL detections for brute force and password spraying in Windows Security logs, with threshold tuning notes and a triage playbook. |
| soc-home-lab | Wazuh and OpenSearch lab: custom rules, agent deployment, ingestion validation, and the full path from alert to incident report. |
| dma-guide | Reference on DMA attack mechanics and the controls that stop them, from IOMMU and VT-d to Kernel DMA Protection. |
Everything is mapped to MITRE ATT&CK and, where behaviour matters more than a screenshot, reproducible from the repository.
SOC analyst, currently Tier 1, handling alert triage, log correlation and detection tuning across Microsoft Sentinel, Splunk and Wazuh. Before the products there was the day job, and the day job is why the products are built the way they are.
Certifications
| Area | Skills, platforms and tools |
|---|---|
| Security operations | Alert triage · Incident investigation · Log correlation · Threat hunting · Detection tuning · Escalation and incident reporting · SOAR playbooks |
| SIEM and detection | Microsoft Sentinel · KQL · Splunk · SPL · Wazuh · OpenSearch · Sigma · YARA · pySigma · MITRE ATT&CK |
| DFIR and malware analysis | Windows event analysis · Process, Prefetch, Registry and filesystem artifacts · Timeline reconstruction · Hash reputation · Behavioural triage · VirusTotal API · Sandbox evidence |
| Network and email security | Wireshark · Scapy · PCAP analysis · Traffic baselining · Port-scan, beaconing and flood detection · Email header analysis · IOC extraction and enrichment |
| Application and AI security | Nuclei · SSRF protection · Domain ownership verification · Secret and PII detection · Data-loss prevention · LLM security · MCP fundamentals |
| Software development | Rust · TypeScript · Python · JavaScript · SQL · React · Tauri · FastAPI · Axum · PostgreSQL · REST APIs |
| Platforms and identity | Windows 10/11 · Linux and Ubuntu · Microsoft Azure · Microsoft Entra ID · Microsoft Store · winget |
| Engineering workflow | Git · GitHub · GitHub Actions · CI/CD · Automated testing · Visual Studio Code · Security scanning · Release automation |
| Threat-intelligence frameworks | STIX/TAXII · Pyramid of Pain · IOC lifecycle · Behaviour-to-technique mapping |
The technologies above are reflected in shipped products, reproducible security labs or day-to-day security operations. They are not a keyword inventory.
Languages — Italian (native), English (C1), French (B2), Spanish (B1)
Open to security engineering work and to conversations about the products above.
aurelio_11@outlook.it · Amsterdam