Detection Engineering
Build useful detections from endpoint, network, identity, and cloud telemetry. Explore behavioral logic, query development, threat hunting, tuning, testing, and validation.
Explore Detection Engineering →Hacker’s Haven
Practical cybersecurity knowledge—rooted in real-world investigation.
Hacker’s Haven is where I break down detection engineering, malware behavior, network fundamentals, security tooling, and the systems quietly powering the digital world. No unnecessary jargon—just clear explanations, useful techniques, and lessons learned from the field.
Inside Hacker’s Haven
Malware Field Notes
Examine how malicious software executes, establishes persistence, communicates with external infrastructure, and leaves evidence behind.
Explore Malware Field Notes →Network Deep Dives
Understand the protocols and infrastructure behind modern communication, including DNS, SMTP, proxies, firewalls, authentication, and network traffic.
Explore Network Deep Dives →Homelab & Tooling
Create environments where you can safely experiment with Security Onion, Linux, cloud infrastructure, scripts, utilities, and defensive security tools.
Explore Homelab & Tooling →Where should I start?
You do not need to understand everything at once. Choose the path that most closely matches what you want to learn.
Understand the Fundamentals
Start with the technologies behind everyday communication: networks, DNS, email, authentication, proxies, and firewalls.
Begin with networking →Investigate Suspicious Activity
Learn how analysts examine alerts, processes, network connections, authentication events, malware behavior, and other evidence.
Enter the investigation path →Build Better Detections
Move from individual indicators to behavioral detections using telemetry, threat intelligence, validation, and thoughtful tuning.
Enter the detection path →Latest Field Notes
Recent explanations, investigations, lab notes, and lessons from Hacker’s Haven.
Detecting Suspicious PowerShell Activity
Learn how to identify suspicious PowerShell behavior using process relationships, command-line activity, encoded commands, and supporting telemetry.
Read field note →Understand the behavior—not just the alert.
Tools change. Indicators expire. Interfaces get redesigned. Understanding how systems behave—and how adversaries misuse them—creates knowledge that lasts beyond a single product or platform.