detection engineering

A custom Wazuh rule pack and reproducible Docker lab that pairs a stock Wazuh agent with a Tetragon eBPF sidecar to catch what stock Wazuh cannot — short-lived process exec, fileless memfd payloads, sub-second TCP connects, kernel module loads, bpf() syscall use, sensitive-file argv reads, setuid escalation. 1 decoder family, 15 rules, 4 distros, 1.59M events validated.

A custom Wazuh rule pack and reproducible Docker lab that catches browser-side shadow AI on developer endpoints — DNS lookups, TLS egress, extension manifests, and native messaging hosts. 4 decoders, 15 rules, MITRE ATT&CK mapped, validated live on Wazuh 4.14.5.

A custom Wazuh rule pack and reproducible Docker lab that catches rogue MCP servers, shadow AI agent activity, and indirect prompt-injection chains on engineering endpoints. 6 decoders, 17 rules, MITRE ATT&CK mapped, validated live on Wazuh 4.14.5.