CTI/DFIR Analyst & Security Engineer on a purple team, with expertise in threat hunting, DFIR, web pentesting and user security awareness training, built up notably as an independent consultant. Passionate about networking, system architecture, security tool development and malware analysis.

📍 Independent purple team cybersecurity consultant currently on hold (my current full-time role takes up all my time) — the tools below were developed in that context and keep evolving in my personal time.

Blue Team Level 1 Security Blue Team	Certified CyberDefender L1 CyberDefenders	Security Analyst (SAL1) TryHackMe	Cyber Security 101 (SEC1) TryHackMe	Security+ CompTIA
Network+ CompTIA	Permis d'Osinter Oscar Zulu Crew	Pentester M2i Formation	Network Administrator FormIP	Tosa DigComp Isograd — Expert

• 🔵 Blue Team & DFIR
• 🔴 Red Team & Offensive Security
• 🛠️ Open-Source Tools
• 📚 Other Projects
• 📫 Contact

Standalone EDR for Linux workstations, written in Rust — no server, no cloud dependency, no agent-to-collector traffic: a single hardened local systemd service, with an optional graphical interface.

• Four independent detection modules, each with its own monitoring loop: ransomware (fanotify, high-entropy write bursts tracked per process/directory/globally, per-machine randomized honeypots), persistence (inotify on cron, sudoers.d, systemd units, XDG autostart, profile.d, rc files — with heuristics on reverse shells and curl-pipe-shell), privilege escalation (unexpected setuid/setgid binaries) and malicious signatures (live YARA scanning via fanotify and on-demand)
• Optional eBPF module (tracepoints on process execution and network connections) for visibility into fileless execution, beyond what file monitoring alone allows
• Enforce-mode response: process termination via pidfd (immune to PID-reuse races, with fallback to a classic kill), quarantine of affected files
• Hardened through several rounds of real-world red-team testing against the active detection modules (fanotify TOCTOU window bypasses, package-manager spoofing, burst-detector evasion...), each confirmed lead reproduced in real conditions and then fixed
• Installer/uninstaller validated end-to-end (real install → real detection → real uninstall) on apt (Debian, Ubuntu), dnf, pacman and zypper

Behavior-based ransomware detection daemon, written in Rust, for Linux servers — built on fanotify(7) (mainline kernel API, no kernel module, no eBPF, no unsafe code in the daemon).

• Doesn't react to file modification per se, but to the specific encryption pattern: a burst of high-entropy writes across many distinct files within a short time window, or the triggering of a honeypot file that no legitimate process should ever touch
• Per-directory baseline: a high-entropy write only counts if the directory previously held plaintext content — avoids false positives on backup/export folders that legitimately receive archives
• Trusted executable whitelist (path + SHA-256), usable for fine-grained exemption of a known backup/encryption script — never applies to honeypot detection
• Enforce-mode response: immediate SIGSTOP of the process, quarantine of affected files, SIGKILL, then incident report and external notification hook (email/Slack/PagerDuty)
• Tested exclusively in disposable Docker containers, never on a host or with real ransomware samples — attack simulators and legitimate workloads (backup, trusted encryption) across 5 distributions
• Also hardened through a dedicated red team audit and an in-depth SAST review of the codebase, on top of the container-based functional testing
• Test results: on a burst of 300 files, only 8 (2.7%) touched before the process was stopped, all recovered intact in quarantine, response time under one second

In-depth static analysis of Windows binaries (EXE/DLL/SYS): IOC extraction, behavioral capability mapping and automated reverse engineering kickoff.

• Structural PE parsing via LIEF: sections, entropy, security mitigations (ASLR, DEP/NX, CFG), imports
• Mapping of potential malicious capabilities (process injection, anti-debug, persistence, keylogging, ransomware, C2) from imported APIs
• IOC extraction (IPs, domains, URLs, Windows registry paths/keys, commands), including from base64-encoded content
• Reverse engineering kickoff via r2pipe (Rizin): entry-point decompilation, cross-references of sensitive APIs
• Full report export in JSON format

Linux equivalent of DeepBlueCLI (SANS): parsing and threat hunting on Linux system logs (auth.log, syslog, audit.log, journalctl) to surface malicious and suspicious behavior during incident response.

• Detection: SSH bruteforce, persistence (SSH keys, cron, UID 0 accounts), privilege escalation, abnormal sudo usage
• Output directly actionable in the terminal, designed for fast-paced investigation
• Used in real conditions on Debian systems

Static document analyzer (PDF, OOXML — docx/xlsx...) to decide whether a received file can be safely opened, without ever executing it.

• Zero external dependency (no third-party library, no called binary): fully standalone tool
• Designed as an extra layer of protection on Linux, in the absence of antivirus
• Accuracy first: strong detection with a minimum of false positives

Linux live forensics script for incident response: zero external dependency, fully in-memory execution, no alteration of the analyzed machine's state.

• Detects binaries communicating with a C2, memory-resident processes with abnormal behavior (e.g. memfd_create, binary deleted from disk), rootkits and hidden files in /tmp, /var/tmp, /dev/shm
• Behavior adapted based on user or root execution, with explicit confirmation before enabling full mode
• Reports the SHA256 of every suspicious file detected, for immediate CTI on hashes

Automation script for enumerating SQL Injection and XSS vulnerabilities on a web target during a pentest: tests URL parameters and forms automatically detected on the page (via BeautifulSoup), with payloads covering classic injection, blind/time-based techniques and several filter-bypass methods.

Script dedicated to enumerating Local File Inclusion vulnerabilities: classic traversal, encoding bypasses (single/double, UTF-8), PHP wrappers (php://filter, php://input, expect://), and log-poisoning detection on common Apache/Nginx log files.

Fuzzer generating cyclic patterns to identify crashes (buffer overflow) in a target binary, with automatic calculation of the crash offset from the returned address.

Secrets scanner for files and directories: detection of AWS keys, GitHub/Slack tokens, private keys, passwords and suspicious base64 strings via a regex ruleset, with JSON report export — useful during code review as part of an audit or pentest.

Public-facing tools, built to be simple, safe and privacy-respecting — no telemetry, no hidden dependency.

Automates updating all Windows programs in one click via winget upgrade --all. A single executable, no external dependency.

Cleaner for temporary files and unwanted cookies (Chrome, Firefox, Brave, Edge, Opera, Vivaldi) — the lightweight alternative to a CCleaner-like tool, requiring no administrator rights and with explicit confirmation before any deletion.

Cross-platform PDF ↔ DOCX conversion, 100% local: no network access required, in the same spirit as La Meuh and Hus-Clean — security and simplicity first.

Security homelab integrating several interconnected SOC, detection and IT management building blocks:

• SOC on Wazuh: alert centralization and correlation
• Wazuh ↔ GLPI integration: critical alerts automatically trigger ticket creation in GLPI via the API
• On-the-fly malware detection: a Samba share hosts the SOC, GLPI and shared files; as soon as a file is dropped there, Wazuh raises a drop alert, ClamAV scans the file, and the result is reported back into Wazuh
• FreeBSD host: runs the Suricata IDS and hosts a dedicated jail exposing the Cowrie honeypot
• Enterprise Cisco networks: designed and secured in Packet Tracer

Malicious binary analysis reports, covering:

• CTI: IOC extraction and correlation
• Static analysis of malware
• Reverse engineering

Guide of tools and commands for the cybersecurity community.