ABIJIT

ambit

A provenance and control plane for Claude Code agents and the MCP servers they connect to. Built in response to s1ngularity and GTG-1002.

An endpoint daemon holds the live verdicts; Wazuh is the fleet plane and never sits in the synchronous path.

Keyboard Hook Detector

Finds processes capable of keylogging and scores how suspicious they look over time. It never hooks the keyboard or captures keystrokes.

Rule engine with persistence and decay, a RandomForest on ClaMP, and an import-table fingerprint mapped to MITRE ATT&CK.

Attack Chain SIEM

A stateful correlation engine that raises an incident only when a full chain appears in order inside a window: access anomaly → C2 beacon → objective.

Beacons are found by interval-variance analysis, not ML, so every flag can be walked through by hand.

Wazuh Investigations

A SOC home lab with both sides in one repo: a stateful, MITRE-mapped adversary telemetry generator, and what I found pointing Wazuh at it.

Includes the detections that didn't fire, each written up with its root cause and the rule needed to close it.

CTF Workshop

An 18-challenge, one-day CTF I built and run for the TinkerHub study jam, for students with no security background. Three rounds, fully offline, one command to launch.

Ghost Recon

A modular recon framework for CTFs, HTB and authorised engagements: ten pipeline stages ending in a self-contained HTML report.

Tools are probed before use, every command runs under a timeout, and output never overwrites.

Hacker101 Writeups

Solved-and-explained: Micro-CMS v1 and v2, A Little Something to Get You Started, and Encrypted Pastebin. The padding-oracle work became a live instructor demo at the study jam.