Ian's CV

Security Portfolio:

ClickFix Phishing Deployment and Detection

10/2025

After finding myself disappointed with default telemetry and detections observed during an engagement with ClickFix malware, I elected to deploy and detect my own version. Engaging with malware and attacker infrastructure this way allows me to comprehensively understand an attack vector, and illuminate the threats to you!

ClickFix
Malware
Elastic
ES|QL

Building a Very Basic Info Stealer

06/2024

Curious about info stealers, and the process of stealing and utilizing stolen cookies, I decided to build and deploy an infostealer in python. I explain the code, the deployment, and lessons learned.

Python
Malware

Deploying Elastic in a Homelab

05/2023

I deployed Elastic and Kibana as a SIEM solution, utilizing Elastic Security, the default rule set, and the Elastic Agent.

Elastic
SIEM
Homelab

Elastic Security Ransomware Experiment

06/2023

In my homelab, I utilized a python ransomware builder, RaaSNet to build a payload and C2 server. I executed this payload, and automated the parsing of relevant Elastic logs, as well as writing custom detection rules for the ransomware.

Elastic
Ransomware
Python
Javascript

Elastic Custom Correlation Rules

08/2023

I rewrote a default detection rule in Elastic Query Language (EQL) to allow for a more specific tune. This utilizes Elastic Query Language, different from KQL or ES|QL, to allow for wildcards in file path and name. The results were then tested with a PowerShell script.

Elastic
Rule Detection
EQL
PowerShell

Older Work: