TerminateX
GitHub ↗A minimal, tiling window manager written in C — direct Xlib/X11 event handling, manual memory management, no framework scaffolding.
- C
- X11 / Xlib
- Systems Programming
New York, NY · open to security engineering roles
I build tools that catch attackers.
Security Engineer / Systems Programmer
Honeypots, telemetry pipelines, and low-level systems software — the tools that watch, contain, and study attackers instead of just blocking them.
Focus
Security-first, systems-deep
The tools and disciplines I actually reach for — capturing attacker behavior, containing it safely, and understanding what's happening underneath the OS while I do it.
Detection & Monitoring
Where most of my time actually goes — watching, correlating, and figuring out what an attacker just did.
- Wazuh (SIEM)
- Log Analysis
- Threat Detection
- Honeypots
- Incident Investigation
- TryHackMe Labs
Offensive Tooling & Recon
- Nmap
- Wireshark
- Metasploit
- Proxychains / Tor
- Network Enumeration
- Vulnerability Scanning
Systems & Internals
- Linux (Arch, Kali, BlackArch)
- Rust
- C / C++
- eBPF
- TCP/IP Networking
- Bash / Python
Platform, Cloud & Certs
- OPNsense Firewall
- VirtualBox / Hyper-V
- AWS
- Google Cloud
- Splunk
- CompTIA CySA+
Featured project
A Rust-based SSH honeypot built for threat capture, not just deception.
Threat capture
Full-interaction SSH honeypot — attackers get a real-feeling shell, so you capture real tooling, real payloads, and real intent instead of scripted probes bouncing off a canned response.
Isolation & containment
Every session gets its own OverlayFS layer and namespace. Nothing an attacker does can touch the host, the base image, or another session running concurrently.
Telemetry pipeline
eBPF probes on execve, connect, and memfd_create stream structured syscall events over SSE to a live dashboard — no polling, no log tailing, no post-hoc parsing.
Attacker behavior analysis
Session replay reconstructs exactly what a session did, in order — command history, network calls, and process creation — for after-the-fact analysis or write-ups.
How it's different from Cowrie
Cowrie emulates a shell in userspace — it's fast to deploy but attackers are interacting with a simulation, and depth is limited to whatever commands the emulator implements. Aegis takes a different approach: real per-session isolation instead of emulation, and kernel-level visibility instead of shell-level logging. eBPF sees every syscall a session actually makes, including anything that escapes a naive shell emulator entirely — memory-resident payloads via memfd_create, outbound C2 callbacks via connect, and process execution via execve. The tradeoff is deliberate: more infrastructure (OverlayFS, namespaces, an eBPF loader) in exchange for ground-truth telemetry instead of an emulator's best guess.
Session lifecycle
Walk through it
Attacker connects. An attacker opens a TCP connection to the exposed SSH listener. Aegis fingerprints the source IP and checks it against the per-IP rate limiter before a session is allocated.
Other projects
More from the toolbox
Smaller builds that back up the fundamentals — offensive tooling and low-level systems work outside the honeypot.
portscanner-in-rust
GitHub ↗A fast, async TCP port scanner built in Rust — the recon fundamentals behind any offensive-security workflow, from scratch.
- Rust
- Offensive Security
- Recon
Pepper
GitHub ↗A minimal, no-frills TCP port scanner written in Python — the same recon fundamentals, built quick for scripting into other workflows.
- Python
- Offensive Security
- Recon
About
A bit about me
I'm drawn to the defender's side of security that still gets to think like an attacker — honeypots, telemetry, and containment systems that turn "someone broke in" into a dataset instead of an incident report. Most of my time goes into understanding attacker behavior closely enough to build tooling around it, in Rust and C where the kernel-level details actually matter.
Day-to-day I run Arch Linux with a Hyprland setup tuned for a fast, keyboard-first workflow.
- Location
- New York, NY
- Focus
- Detection & Honeypots
- Setup
- Arch Linux + Hyprland
- Currently
- Per Scholas Cybersecurity — grad. June 2026