Red team operations
Intelligence-driven exercises that follow complete attack chains across identity, endpoints, applications and hybrid infrastructure, then carry the useful lessons into detection and response.
Security engineer · London
Hello, I’m Moaaz.
I’m a senior security engineer specialising in full-scope red team operations, adversary emulation and threat simulation. I trace the routes a determined attacker could use through hybrid environments, then turn that work into practical improvements for defenders.
Over the past decade I’ve led red and purple team engagements, developed offensive tooling, and worked alongside defenders to turn attack paths into stronger detections and concrete remediation. I’m particularly interested in routes that do not depend on phishing.
01
The work
Adversary emulation
Objective-led work grounded in APT tradecraft and MITRE ATT&CK, including payload adaptation, EDR-aware execution and routes that do not assume phishing will work.
Offensive engineering
Building and operationalising tooling and infrastructure for repeatable red and purple team work, with clear remediation rather than a pile of findings.
Vulnerability research
Business-logic, access-control and injection findings, with five CVE records and acknowledgements from public security programmes.
02
Tools
attack-path-review
Offline · JSON, HTML, DOT and SARIF
Use it when a review has established the trust relationships but the remediation order is still arguable. It enumerates bounded routes, measures shared choke points, computes a minimum edge cut and reruns the model with each edge removed.
threat-sim-preflight
Offline · TOML or JSON plans · SARIF
A guardrail for the work before a simulation begins. It checks the approved window, scope, dependencies, stop and cleanup steps, telemetry freshness and detection ownership; a local ATT&CK STIX bundle can verify technique IDs.
03
Selected public work
SolarWinds Web Help Desk · 2021
A trust decision hidden in a referrer header
Web Help Desk used the HTTP referrer as part of an access restriction around its setup flow. Spoofing that value exposed an administrator creation path outside the expected network range. SolarWinds credited the report and fixed the issue in version 12.7.6.
Critical finding recognition
Bugcrowd included me in its Q3 2020 P1 Warriors list. Google and Esri also record acknowledgements through their public security programmes.
Research archive
Five public vulnerability records are collected with their vendor, NVD and Exploit-DB references.
04