CloudTrail Investigator
What an AWS identity did, what it touched, and whether it tried to hide.
5/ 23
in-scope ATT&CK techniques detected on a held-out test set. Published as measured.1
Enterprise networks by day. Moving into security.
Evidence first.
I build security tools where every claim points to its record and every rate shows its denominator.
Four projects. Shipped.
Each with tests, CI and a README that names its own limits.
Prompt Injection Tester
Payloads against a self-built chatbot on a local model, two defenses, a significance test.
0/ 48
bypasses with the output filter, against 10 / 48 for the undefended baseline.2
SOC Detection Lab
Failed Windows logons followed by a success, from hypothesis to Python, SPL and real events from my own test VM.
1/ 1
expected alert on the native capture, fixed before the detector ran and met unchanged. Splunk result identical.3
Password Vault
A local password vault in Java. Title, username and password sealed together in one AES-256-GCM ciphertext.
64MiB
of memory for every master-password guess: Argon2id in the RFC 9106 configuration.4
Also building.
Outside security: a product of my own.
Mobile app · In development
Was koche ich?
German for “What should I cook?”
Say what you feel like eating and get a recipe that fits your diet: ingredients, steps and nutrition, generated by AI. Saved recipes and history stay on the device.
waskocheich.eu
Coming soon to the App Store
How I work.
Labels before rules.
Ground truth is frozen before the first detection is written.
Denominators, always.
A rate without its count is a claim, not a result.
Limits in the README.
What a tool misses is documented next to what it finds.
Public or own data only.
Nothing from employers or customers. Ever.
Right now.
By day, enterprise network operations. In between, a B.Sc. in Cybersecurity and the next project. Get things done.
StudyingB.Sc. Cybersecurity, IU
Based inIngolstadt → München
Open toRed team · Forensics · Blue team
Let’s talk.
Roles, projects or a question about one of the tools.