h4voxh4vox@local:~$ ./render --profile --verbose[ok]
Havox
security researcher & tool builder
I study how Windows behaves underneath the documented API surface, reverse the parts that matter, and turn that understanding into tooling for adversary emulation and sharper detections.
status: open to research collaboration · uptime: coffee-driven
5+
research tools shipped
2
active builds
4
published notes
∞
hours in a debugger
About
./aboutOffense informs defense.
Self-taught, starting from Windows internals and malware analysis and moving outward into reverse engineering and offensive tooling. Everything offensive stays inside authorized labs, purple-team engagements, and simulation work.
The work runs on two rails: building realistic adversary emulation capability, and feeding what that exposes back into detection engineering — EDR implementation, review and testing on one side; YARA, YARA-L and KQL rule work, log pipelines and threat hunting on the other.
Detection and telemetry work spans Google SecOps, Microsoft Sentinel and the Elastic Stack, with Windows and endpoint data as the centre of gravity, plus Azure and Active Directory simulation for identity-side coverage.
Focus areas
- Adversary Emulation / Simulation
- Threat Hunting
- Detection Engineering (YARA / YARA-L / KQL)
- Reverse Engineering
- Windows Internals
- Exploit Development Research
- Custom Tooling & Loaders
- EDR: implementation, review, testing
- SIEM: Google SecOps, Sentinel, Elastic
- Log pipelines & endpoint telemetry
- Azure / Active Directory
- IaC + AI-assisted automation
- Agentic SOC experiments
Stack
./stackTools that show up in the daily loop.
Languages
- C / C++
- C#
- Python
- PowerShell
- Assembly (x64)
Offensive
- Cobalt Strike
- Sliver
- Havoc
- Custom loaders
- MITRE ATT&CK
Defensive
- YARA / YARA-L
- KQL
- Sigma
- Velociraptor
- Sysmon / ETW
Platforms
- Google SecOps
- Microsoft Sentinel
- Elastic
- Azure / AD
- Windows
Projects
./projectsResearch builds and offensive tooling.
DynLoader
↗C++ · Windows · loader research
Modular Windows loader for EDR-evasion research. Indirect syscalls (Hell's Gate / Tartarus Gate style variants with multi-stage SSN resolution), manual PE parsing and section mapping, PEB walking, API hashing with dynamic resolution, and fileless HTTP delivery with optional AES. Core logic is modularized for research reuse.
github.com → DynLoaderPlanqX EDR
↗Windows · EDR · in development
Open-source Windows Endpoint Detection and Response exploring real-time system and network telemetry: API hooking, ELAM, ETW integration, and defensive instrumentation. Ongoing research build.
github.com/h4vox/PlanqX_EDRAtlas CSPM
↗Cloud posture · multi-cloud
Cloud Security Posture Management tooling — configuration inventory, drift, and misconfiguration surfacing across cloud environments.
github.com/h4voxCommand Privilege Management for PowerShell
↗Windows · authentication layer
Additional authentication and privilege-control layer for PowerShell and Command Prompt sessions on Windows endpoints.
github.com/h4voxRecon & vulnerability tooling
↗PowerShell · Python
Assorted information-gathering scripts, a lightweight vulnerability scanner, and small utilities used across authorized lab and purple-team work.
github.com/h4vox — repositoriesWriting
./writingNotes from the lab, published as I go.
The Art of Malware Obfuscation
malware-techniquesSurvey of obfuscation strategies used in modern samples and what actually raises the cost for analysis.
Quickstart
malware-techniques · series introEntry point for the malware techniques series: scope, lab setup, and how the notes are structured.
XOR Malware Execution
malware-techniquesWalkthrough of XOR-based payload staging and execution patterns commonly seen in real samples.
How to Detect XOR Obfuscation
detection · YARADetection-side companion: signal patterns, YARA constructs, and telemetry angles for spotting XOR-obfuscated payloads.
$ ./contact --init
Building something adversarial or defensive?
Always up for research collaboration, detection work, or breaking down a technique until it stops being magic.