Welcome

Welcome to AllMindSecurity. I’m a cybersecurity engineer and Air Force veteran focused on offensive security, cloud architecture, detection engineering, and practical automation.

This site serves two purposes: documenting the tools and infrastructure I build, and publishing reproducible technical articles for other security practitioners. Topics include red-team engineering, Azure and AWS security, detection validation, infrastructure as code, and lab development.

Where possible, articles include the implementation details, design decisions, and tradeoffs needed to reproduce the work in your own environment. By publishing practical tools, lessons learned, and reproducible labs, I hope to give back to the red-team community and help other practitioners solve real operational problems.

Check out the latest articles to get started.

Projects

Selected projects demonstrating my work across offensive security engineering, cloud infrastructure, detection validation, and automation. Offensive tooling is developed for authorized engagements and controlled lab environments.

  • LnkScrubber: A C# command-line tool for inspecting Windows shortcut metadata and stripping, anonymizing, or manually editing its TrackerDataBlock before a .lnk leaves your environment.
  • Automated Payload Build System: A Python and Tkinter desktop application that reduces build and release time for engagement-ready loaders. It supports multiple C2 platforms, MSVC-based builds, configurable execution modes, and controlled anti-analysis options for safe, repeatable compilation.
  • Red Team Operational Logging Platform: A containerized Flask and Gunicorn platform that centralizes operational logs into activity-based views, reducing manual reporting, licensing requirements, and administrative overhead.
  • Web-Based Build Orchestration Platform: A containerized Flask interface for producing consistent builds across toolchains, including GCC and MinGW, with an emphasis on repeatability and controlled lab validation.
  • Beacon Object File Tooling: A collection of focused operator utilities developed to solve recurring requirements during authorized engagements.
    • Chunker: Chunks files/directories based on user-defined sizing and supports encrypted packaging for transport/storage.
    • CheckSigned: Validates whether binaries are signed (including handling cases beyond simple catalog-based checks).
    • SuspendLog: Targets specific process threads and suspends them to suppress host logging.
    • Custom Inline-ExecuteAssembly: .NET execution that uses a custom implementation of ETW and AMSI patching.
    • archiver: Walks a directory recursively, builds a table of contents (max 2048 files, 260-char paths), and writes raw file data into one archive.
    • eraser: Performs five passes (0x00, 0xFF, random, 0xAA, random) with a 4 KB buffer, flushing after each pass. Truncates the file to zero length and then deletes it; reports each pass plus final status.
    • recursive-dir: Recursive directory search utilities with operator-defined filters.
  • Internal Security Operations Platforms: Web applications supporting internal red-team workflows using Apache, Nginx, PHP, Azure, AWS Lambda, and cloud load balancers.
  • Cross-Language Loader Research: Implementations in C, C++, C#, PowerShell, Java, and Python focused on modular design, repeatable builds, and controlled validation in authorized lab environments.
  • Azure Detection Validation Lab: A reproducible cloud security environment using Microsoft Defender and Microsoft 365 services to measure detection visibility and refine safe, repeatable testing workflows.

About Me

I’m an Air Force veteran who served nine and a half years as a cyberspace operator, with more than 15 years of experience across cybersecurity and engineering. My background includes software development, cloud security architecture, internal auditing, red teaming, enterprise network operations, and compliance.

I currently serve as a Senior TTP Researcher supporting a federal client. Previously, I worked as a Senior Red Team Operator supporting a Department of Defense cyber organization. Before that, I performed cybersecurity auditing, penetration testing, and red-team assessments across a large private-equity portfolio.

I’ve held technical and leadership roles supporting mission-critical systems, including leading a 40-person team aboard the National Airborne Operations Center responsible for global command-and-control communications.

I enjoy turning operational problems into maintainable tools, automation, and reproducible environments. AI is part of my engineering workflow, but not a replacement for engineering judgment. I use LLMs to accelerate research, prototyping, code iteration, and documentation while retaining ownership of requirements, architecture, security decisions, validation, and final implementation.

Certifications: CRTL, CRTID, AT-RTO, CRTO, CARTP, CRTP, OSCP, CISSP, CEH, Security+, Linux+, MS-900

Military Training

  • Undergraduate Cyber‑Warfare Training
  • Advanced Network Operations Officer Course
  • Carnegie Mellon SEI Cyber 200 ADL Labs

Industry Training

  • SpecterOps / Black Hat — Adversary Tactics: Red Team Operations
  • AntiSyphon — HackerOps: Red Team Infrastructure as Code
  • Sektor7 — Malware Essentials / Intermediate Development / Windows Evasion
  • Binary Offensive — Modern Initial Access and Evasion
  • MalDevAcademy — Malware Development
  • Hack The Box Pro Labs — Zephyr
  • White Knight Labs — Offensive Development and Advanced Red Team Operations

Articles

Technical deep dives, security research, and reproducible labs covering offensive tooling, cloud architecture, detection engineering, and practical automation.

Tooling

Your .lnk Files Are Snitching on You — LnkScrubber

See what Windows shortcut files can reveal about their target environment, then inspect and sanitize that metadata with LnkScrubber.

AWS

UDC2 on AWS: SQS

AWS

UDC2 on AWS: DynamoDB