https://44e06765.meistsec-blog.pages.dev/Recent content on MEISTSECHugoen-usFri, 21 Aug 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/lease/Fri, 21 Aug 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/lease/Eleven IPs scanned my WAN. My firewall said Iran, but the servers were in Amsterdam. Following the address space led to twelve RIPE LIR memberships sharing one company registration number, while several of my own threat-hunting heuristics failed along the way.https://44e06765.meistsec-blog.pages.dev/posts/threatmeister/Fri, 17 Jul 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/threatmeister/Part two of the malware lab series. The KVM lab generates a firehose of Wazuh alerts — Threat Meister is the terminal tool that turns them into a signed, scored, monthly threat-hunting report by cross-referencing them against VirusTotal and your own malware catalog.https://44e06765.meistsec-blog.pages.dev/posts/malwarelab/Fri, 10 Jul 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/malwarelab/A complete walkthrough of building a production-grade malware analysis environment using KVM, PFSense, Remnux, FLARE-VM, Mullvad WireGuard VPN, mitmproxy TLS interception, and Wazuh SIEM — inspired by c3rb3ru5d3d53c&#39;s approach.https://44e06765.meistsec-blog.pages.dev/posts/arch_threat_hunt/Mon, 15 Jun 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/arch_threat_hunt/When 400+ Arch AUR packages got hijacked to drop a Rust credential stealer with an optional eBPF rootkit, I ran the full hunt against my own Arch box. Spoiler: clean — but two checks looked like hits and weren&#39;t, providing a good lessons learned experience.https://44e06765.meistsec-blog.pages.dev/posts/vacuum/Mon, 18 May 2026 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/posts/vacuum/A week-long investigation into a Suricata IDS alert for BPFDoor backdoor activity on a Roborock Q10 vacuum. Spoiler: it wasn&#39;t BPFDoor. The actual cause is more interesting — and reproducible.https://44e06765.meistsec-blog.pages.dev/posts/update/Fri, 15 May 2026 15:51:25 -0400https://44e06765.meistsec-blog.pages.dev/posts/update/I&#39;m backhttps://44e06765.meistsec-blog.pages.dev/posts/attackchain1/attackchain/Thu, 25 May 2023 15:02:43 -0500https://44e06765.meistsec-blog.pages.dev/posts/attackchain1/attackchain/Phase 1https://44e06765.meistsec-blog.pages.dev/posts/segtest/segtesting/Mon, 08 May 2023 13:22:54 -0500https://44e06765.meistsec-blog.pages.dev/posts/segtest/segtesting/An nmap playbook for validating network segmentation controls.https://44e06765.meistsec-blog.pages.dev/posts/pythonctf/pythonctf/Sun, 30 Oct 2022 14:38:28 -0500https://44e06765.meistsec-blog.pages.dev/posts/pythonctf/pythonctf/<p><img loading="lazy" src="https://44e06765.meistsec-blog.pages.dev/posts/pythonctf/images/python.jpg"></p> <p>10/30/2022:</p> <p>I love participating in Capture The Flag (CTF) events. When I first became focused on pursuing a career in cybersecurity, I was encouraged by many in the community to compete in the numerous CTFs that are available for all skill levels. What I enjoy most about them, as opposed to standard IT/Security courses, is that the CTF revolves around critical thinking and researching solutions to each challenge. There is no curriculum to reference; it’s all on you!</p>https://44e06765.meistsec-blog.pages.dev/posts/pmat/pmat/Thu, 01 Sep 2022 15:02:43 -0500https://44e06765.meistsec-blog.pages.dev/posts/pmat/pmat/PMAT Sample Analysishttps://44e06765.meistsec-blog.pages.dev/posts/firewall/firewall_configurations/Tue, 19 Apr 2022 14:24:57 -0500https://44e06765.meistsec-blog.pages.dev/posts/firewall/firewall_configurations/Hardening firewalld on Fedora Workstation for a security research host.https://44e06765.meistsec-blog.pages.dev/posts/brainpan/brainpan/Wed, 30 Mar 2022 10:49:19 -0500https://44e06765.meistsec-blog.pages.dev/posts/brainpan/brainpan/Brainpan 1 THM Walk-Through Automated Attackhttps://44e06765.meistsec-blog.pages.dev/posts/hello/hello_world/Thu, 04 Jul 1776 15:22:54 -0500https://44e06765.meistsec-blog.pages.dev/posts/hello/hello_world/My first blog!https://44e06765.meistsec-blog.pages.dev/donate/Mon, 01 Jan 0001 00:00:00 +0000https://44e06765.meistsec-blog.pages.dev/donate/<p>If any of my projects or posts have been useful to you, you can support my work below. Entirely optional — thank you either way.</p> <h2 id="buy-me-a-coffee">Buy Me a Coffee</h2> <p><a href="https://buymeacoffee.com/meistsec">buymeacoffee.com/meistsec</a></p> <h2 id="github-sponsors">GitHub Sponsors</h2> <p><a href="https://github.com/sponsors/MEISTSEC">github.com/sponsors/MEISTSEC</a></p> <h2 id="bitcoin">Bitcoin</h2> <pre><code>bc1qjeyphyc6ypnmkjclup2c3yjjts2ljn6grsqm2y </code></pre> <p>This address is signed so you can confirm it hasn&rsquo;t been tampered with. See the <a href="https://github.com/MEISTSEC/threat_meister/blob/main/DONATE.md">verification details</a> in the Threat Meister repo.</p>