.S_sSSs sSSs sSSs sSSs .S_SSSs .S_SsS_S. .S_SSSs .S .S_SSSs .S_sSSs sSSs_sSSs
.SS~YS%%b d%%SP d%%SP d%%SP .SS~SSSSS .SS~S*S~SS. .SS~SSSSS .SS .SS~SSSSS .SS~YS%%b d%%SP~YS%%b
S%S `S%b d%S' d%S' d%S' S%S SSSS S%S `Y' S%S S%S SSSS S%S S%S SSSS S%S `S%b d%S' `S%b
S%S S%S S%S S%| S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S
S%S S&S S&S S&S S&S S%S SSSS%S S%S S%S S%S SSSS%P S&S S%S SSSS%S S%S S&S S&S S&S
S&S S&S S&S_Ss Y&Ss S&S S&S SSS%S S&S S&S S&S SSSY S&S S&S SSS%S S&S S&S S&S S&S
S&S S&S S&S~SP `S&&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S
S&S S&S S&S `S*S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S
S*S d*S S*b l*S S*b S*S S&S S*S S*S S*S S&S S*S S*S S&S S*S d*S S*b d*S
S*S .S*S S*S. .S*P S*S. S*S S*S S*S S*S S*S S*S S*S S*S S*S S*S .S*S S*S. .S*S
S*S_sdSSS SSSbs sSS*S SSSbs S*S S*S S*S S*S S*S SSSSP S*S S*S S*S S*S_sdSSS SSSbs_sdSSS
SSS~YSSY YSSP YSS' YSSP SSS S*S SSS S*S S*S SSY S*S SSS S*S SSS~YSSY YSSP~YSSY
SP SP SP SP SP
Y Y Y Y Y
SOC ANALYST · PURPLE TEAM · TOOL BUILDER
David Hernández · operator · out of pattern
mmm, ' 'T ] m, ,m .mm .m .., m, ] ] ]`] P `]]] ] ]`] ' ] ] ] ]"" [ ]]] ] ] ] ."T ] ] 'b/ [ ]]] .dm ] ] 'mT 'm
operator_state : active focus : detection engineering · purple team · automation workspace : live
now · Entra ID detection engineering · Azure-Sentinel OSS · flipper purple team · SIGMA rules
mm . . ]` `.dm m, .dm . . m, 'bm ] ' ] ] ] ] ] ' '[ ] ."T ] ] ] "\ 'md` 'm 'mT 'm 'mT 'm/
Detection Engineering — MITRE ATT&CK · SIEM correlation · Threat hunting
Purple Team Operations — Red/Blue convergence · Adversary simulation · Defensive validation
Automation & Tooling — Python · Bash · APIs · Internal frameworks
BOFA — Local-first execution fabric for authorized security work: bug bounty workspaces, evidence, policy-gated AI copilots
Python · Bash · Docker · Terraform · MITRE ATT&CK · Zabbix
, , .mm ] ' ] ' .
',/ m, m, ] md .m md .m .dm
T` ]`] ] ' ] ]`T ] ]`T ] ]
] ]"" "\ ] ] ] ] ] ] ] ]
] 'b/ 'm/ .dm 'bW .dm 'bW .dm 'm
Entra ID Detection Engineering — KQL hunting queries and SIGMA rules for identity attack detection · 19 PRs merged to Azure/Azure-Sentinel · 3 rules merged to Elastic · 1 fix merged to SigmaHQ (5 more open) · github.com/descambiado/entra-id-detection-engineering
Flipper Purple Team — BadUSB attack payloads paired with exact SIGMA detection rules and KQL hunting queries · tested end-to-end · github.com/descambiado/flipper-purple-team
SotyHUB — Founder, Main Ecosystem Developer, Cybersecurity community & knowledge ecosystem · sotyhub.com
BOFA — Local-first execution fabric for authorized security work: duplicate-aware bug bounty workspaces, evidence, and policy-gated AI copilots · github.com/descambiado/BOFA
SOTYPOT — Modular multi-honeypot platform (TPOT CE remix) · github.com/descambiado/Sotypot
Baby Pluto Guard — Educational monitoring & detection scanner
.m .m .m ` [ ` [ ` [ .P .P .P ' ' ' ] ] ]
No construyo para métricas. No publico para validación.
Publico para externalizar conocimiento operativo.
Aquí hay: iteraciones, fallos, sistemas parciales, experimentos vivos.
Si te sirve, úsalo. Si lo puedes mejorar, contribuye.
Operador. Construyo en público. descambiado = fuera del patrón esperado.
.m ] 'T .` `]., m, .., .., m, ] m, ] ]`] ' ] ]`] ]`] ]`] ] ] ' ] ] ] ."T ] ] ] ] ]"" ] "\ \m`] ] 'mT ] ] ] ] 'b/ 'm 'm/
WEB · SOTYHUB · DISCORD · YOUTUBE · GITHUB
═══════════════════════════════════
descambiado != broken · descambiado == out of pattern
David Hernández · @descambiado · operator · live · 2026