I find what attackers try to hide and turn it into detections that run in production.
Target: Ailton Rocha
São Paulo, BR
Hypothesis-driven hunting, production detections and AI agents in the SOC.
I map TTPs in MITRE ATT&CK, hunt threats across EDR and SIEM telemetry and turn findings into detection rules in CrowdStrike, Cortex XDR and Splunk. My offensive foundation, with the DCPT and 4 Hack The Box Pro Labs, helps me think like the attacker and write detections that are harder to evade.
What I doI hunt threats by hypothesis with MITRE ATT&CK and TaHiTI across EDR and SIEM telemetry.
What the organization getsHelps surface a compromise earlier, before it becomes an incident, a breach or ransomware.
ProofeCTHP (ID 96700960); technique coverage mapped in MITRE ATT&CK
What I doI turn hunting findings into detection rules in CrowdStrike (CQL), Cortex XDR and Splunk (SPL), with continuous tuning.
What the organization getsMore reliable alerts: less noise for the SOC and more time for what is real.
ProofRules in production on CrowdStrike and Cortex XDR; LogScale documentation used by SOC teams
What I doI build autonomous AI agents for Tier 1 triage and automate workflows with Python and PowerShell.
What the organization getsLess repetitive work for analysts and more time for investigation.
ProofTier 1 triage agent in production; knowledge-rag, an open-source MCP server
What I doI simulate APT group TTPs with Breach and Attack Simulation and measure what each tool detects and blocks.
What the organization getsSecurity investment decisions based on evidence of what the defenses detect and block.
ProofTTPs mapped in MITRE ATT&CK v19 with Cymulate; EDR, XDR and Identity Protection evaluated under stress tests
What I doOffensive knowledge of Active Directory, reverse engineering and defense evasion.
What the organization getsDetections designed from how attacks actually happen, with fewer blind spots.
ProofDCPT; hands-on reverse engineering knowledge
What I doI take part in containing ransomware, APT and phishing incidents and produce threat intelligence for leadership.
What the organization getsA more organized incident response and leadership informed about the threats to its sector.
ProofeCIR (ID 104767045); monthly Threat Intelligence bulletin
Radar: skills
Each axis shows the level I can back with proof.
5 Impact
eCTHP (ID 96700960); less manual triage by automating hunting workflows
3 Certification
DCPT, a hands-on pentest exam; Purple Team with Breach and Attack Simulation
5 Impact
measured false-positive reduction; rules and IOAs in production on CrowdStrike, Cortex XDR and Splunk
4 Production
eCIR (ID 104767045); 3 years in CSIRT handling ransomware, APT and spear phishing
5 Impact
Tier 1 AI triage confirmed in blind review; knowledge-rag adopted by the open-source community
2 Practice
monthly Threat Intelligence bulletin for leadership
Soft skills, each backed by the fact behind it.
Creator and maintainer
100% local RAG MCP server for AI agents, with hybrid search (BM25, semantic and RRF), cross-encoder reranking and 20 file formats.
knowledge-rag on GitHubFully automated robot that applies and audits logon-hour restrictions (logonHours) across multiple Active Directory domains. Restricting logon hours shrinks the window for off-hours credential abuse, but done by hand it doesn't scale and leaves no audit trail. The robot runs unattended every day, processes only what changed, verifies every write byte by byte and can roll back any change.
Scripts on GitHubRed team framework for authorized operations, with reverse shell session management, artifact signing and MCP automation with AI agents.