https://a1b829e6.meistsec-blog.pages.dev/Recent content on MEISTSECHugoen-usFri, 10 Jul 2026 00:00:00 +0000https://a1b829e6.meistsec-blog.pages.dev/posts/malwarelab/Fri, 10 Jul 2026 00:00:00 +0000https://a1b829e6.meistsec-blog.pages.dev/posts/malwarelab/A complete walkthrough of building a production-grade malware analysis environment using KVM, PFSense, Remnux, FLARE-VM, Mullvad WireGuard VPN, mitmproxy TLS interception, and Wazuh SIEM — inspired by c3rb3ru5d3d53c&#39;s approach.https://a1b829e6.meistsec-blog.pages.dev/posts/arch_threat_hunt/Mon, 15 Jun 2026 00:00:00 +0000https://a1b829e6.meistsec-blog.pages.dev/posts/arch_threat_hunt/When 400+ Arch AUR packages got hijacked to drop a Rust credential stealer with an optional eBPF rootkit, I ran the full hunt against my own Arch box. Spoiler: clean — but two checks looked like hits and weren&#39;t, providing a good lessons learned experience.https://a1b829e6.meistsec-blog.pages.dev/posts/vacuum/Mon, 18 May 2026 00:00:00 +0000https://a1b829e6.meistsec-blog.pages.dev/posts/vacuum/A week-long investigation into a Suricata IDS alert for BPFDoor backdoor activity on a Roborock Q10 vacuum. Spoiler: it wasn&#39;t BPFDoor. The actual cause is more interesting — and reproducible.https://a1b829e6.meistsec-blog.pages.dev/posts/update/Fri, 15 May 2026 15:51:25 -0400https://a1b829e6.meistsec-blog.pages.dev/posts/update/I&#39;m backhttps://a1b829e6.meistsec-blog.pages.dev/posts/attackchain1/attackchain/Thu, 25 May 2023 15:02:43 -0500https://a1b829e6.meistsec-blog.pages.dev/posts/attackchain1/attackchain/Phase 1https://a1b829e6.meistsec-blog.pages.dev/posts/segtest/segtesting/Mon, 08 May 2023 13:22:54 -0500https://a1b829e6.meistsec-blog.pages.dev/posts/segtest/segtesting/An nmap playbook for validating network segmentation controls.https://a1b829e6.meistsec-blog.pages.dev/posts/pythonctf/pythonctf/Sun, 30 Oct 2022 14:38:28 -0500https://a1b829e6.meistsec-blog.pages.dev/posts/pythonctf/pythonctf/<p><img loading="lazy" src="https://a1b829e6.meistsec-blog.pages.dev/posts/pythonctf/images/python.jpg"></p> <p>10/30/2022:</p> <p>I love participating in Capture The Flag (CTF) events. When I first became focused on pursuing a career in cybersecurity, I was encouraged by many in the community to compete in the numerous CTFs that are available for all skill levels. What I enjoy most about them, as opposed to standard IT/Security courses, is that the CTF revolves around critical thinking and researching solutions to each challenge. There is no curriculum to reference; it’s all on you!</p>https://a1b829e6.meistsec-blog.pages.dev/posts/pmat/pmat/Thu, 01 Sep 2022 15:02:43 -0500https://a1b829e6.meistsec-blog.pages.dev/posts/pmat/pmat/PMAT Sample Analysishttps://a1b829e6.meistsec-blog.pages.dev/posts/firewall/firewall_configurations/Tue, 19 Apr 2022 14:24:57 -0500https://a1b829e6.meistsec-blog.pages.dev/posts/firewall/firewall_configurations/Hardening firewalld on Fedora Workstation for a security research host.https://a1b829e6.meistsec-blog.pages.dev/posts/brainpan/brainpan/Wed, 30 Mar 2022 10:49:19 -0500https://a1b829e6.meistsec-blog.pages.dev/posts/brainpan/brainpan/Brainpan 1 THM Walk-Through Automated Attackhttps://a1b829e6.meistsec-blog.pages.dev/posts/hello/hello_world/Thu, 04 Jul 1776 15:22:54 -0500https://a1b829e6.meistsec-blog.pages.dev/posts/hello/hello_world/My first blog!https://a1b829e6.meistsec-blog.pages.dev/donate/Mon, 01 Jan 0001 00:00:00 +0000https://a1b829e6.meistsec-blog.pages.dev/donate/<p>If any of my projects or posts have been useful to you, you can support my work below. Entirely optional — thank you either way.</p> <h2 id="buy-me-a-coffee">Buy Me a Coffee</h2> <p><a href="https://buymeacoffee.com/meistsec">buymeacoffee.com/meistsec</a></p> <h2 id="github-sponsors">GitHub Sponsors</h2> <p><a href="https://github.com/sponsors/MEISTSEC">github.com/sponsors/MEISTSEC</a></p> <h2 id="bitcoin">Bitcoin</h2> <pre><code>bc1qjeyphyc6ypnmkjclup2c3yjjts2ljn6grsqm2y </code></pre> <p>This address is signed so you can confirm it hasn&rsquo;t been tampered with. See the <a href="https://github.com/MEISTSEC/threat_meister/blob/main/DONATE.md">verification details</a> in the Threat Meister repo.</p>