I'm a CTI analyst and detection engineer focused on converting threat intelligence into operational detections. My work covers structured actor profiling, TTP-to-detection workflows, MITRE ATT&CK mapping, and AI-assisted analysis methodology.
What I build:
Israel & Middle East threat actor research — A structured repository covering 21 state-linked and geopolitically-motivated actors: OilRig, MuddyWater, APT42, Arid Viper, WIRTE, UNC1860, Agrius, and more. Each profile maps TTPs to ATT&CK, includes detection hypotheses, and links to KQL rules.
CTI Analyst Field Manual — A practitioner handbook covering source reliability (Admiralty scale), analytic discipline, attribution methodology, infrastructure pivoting, and the full CTI-to-detection workflow.
ThreatMapper Web — A browser-native MITRE ATT&CK visualization tool for group comparison, TTP overlap analysis, and coverage mapping across multiple domains.
Full knowledge base, all projects, and detection code: 1200km.com
What I write about on Medium:
Finished CTI investigations with full methodology. AI-assisted analyst workflows. Detection engineering from real threat actor data. Offensive security research — with explicit defender implications for each technique.
Everything is based on authorized testing, real lab environments, and documented evidence chains.
