.S_sSSs sSSs sSSs sSSs .S_SSSs .S_SsS_S. .S_SSSs .S .S_SSSs .S_sSSs sSSs_sSSs .SS~YS%%b d%%SP d%%SP d%%SP .SS~SSSSS .SS~S*S~SS. .SS~SSSSS .SS .SS~SSSSS .SS~YS%%b d%%SP~YS%%b S%S `S%b d%S' d%S' d%S' S%S SSSS S%S `Y' S%S S%S SSSS S%S S%S SSSS S%S `S%b d%S' `S%b S%S S%S S%S S%| S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S%S S&S S&S S&S S&S S%S SSSS%S S%S S%S S%S SSSS%P S&S S%S SSSS%S S%S S&S S&S S&S S&S S&S S&S_Ss Y&Ss S&S S&S SSS%S S&S S&S S&S SSSY S&S S&S SSS%S S&S S&S S&S S&S S&S S&S S&S~SP `S&&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S `S*S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S&S S*S d*S S*b l*S S*b S*S S&S S*S S*S S*S S&S S*S S*S S&S S*S d*S S*b d*S S*S .S*S S*S. .S*P S*S. S*S S*S S*S S*S S*S S*S S*S S*S S*S S*S .S*S S*S. .S*S S*S_sdSSS SSSbs sSS*S SSSbs S*S S*S S*S S*S S*S SSSSP S*S S*S S*S S*S_sdSSS SSSbs_sdSSS SSS~YSSY YSSP YSS' YSSP SSS S*S SSS S*S S*S SSY S*S SSS S*S SSS~YSSY YSSP~YSSY SP SP SP SP SP Y Y Y Y Y 

SOC ANALYST · PURPLE TEAM · TOOL BUILDER

_{David Hernández · operator · out of pattern}

[ web ] · [ repo ]

 mmm, ' 'T ] m, ,m .mm .m .., m, ] ] ]`] P `]]] ] ]`] ' ] ] ] ]"" [ ]]] ] ] ] ."T ] ] 'b/ [ ]]] .dm ] ] 'mT 'm 

operator_state : active
focus : detection engineering · purple team · automation
workspace : live

now · Entra ID detection engineering · Azure-Sentinel OSS · flipper purple team · SIGMA rules

 mm . . ]` `.dm m, .dm . . m, 'bm ] ' ] ] ] ] ] ' '[ ] ."T ] ] ] "\ 'md` 'm 'mT 'm 'mT 'm/ 

Detection Engineering — MITRE ATT&CK · SIEM correlation · Threat hunting

Purple Team Operations — Red/Blue convergence · Adversary simulation · Defensive validation

Automation & Tooling — Python · Bash · APIs · Internal frameworks

BOFA Suite — 150+ tools for Blue/Red/Purple Team operations

_{Python · Bash · Docker · Terraform · MITRE ATT&CK · Zabbix}

 , , .mm ] ' ] ' . ',/ m, m, ] md .m md .m .dm T` ]`] ] ' ] ]`T ] ]`T ] ] ] ]"" "\ ] ] ] ] ] ] ] ] ] 'b/ 'm/ .dm 'bW .dm 'bW .dm 'm 

Entra ID Detection Engineering — KQL hunting queries and SIGMA rules for identity attack detection · 19 PRs merged to Azure/Azure-Sentinel · 3 rules merged to Elastic · github.com/descambiado/entra-id-detection-engineering

Flipper Purple Team — BadUSB attack payloads paired with exact SIGMA detection rules and KQL hunting queries · tested end-to-end · github.com/descambiado/flipper-purple-team

SotyHUB — Founder, Main Ecosystem Developer, Cybersecurity community & knowledge ecosystem · sotyhub.com

BOFA — Cybersecurity Operations Framework Advanced (174 tools) · github.com/descambiado/BOFA

SOTYPOT — Modular multi-honeypot platform (TPOT CE remix) · github.com/descambiado/Sotypot

Baby Pluto Guard — Educational monitoring & detection scanner

 .m .m .m ` [ ` [ ` [
.P .P .P ' ' ' ] ] ] 

No construyo para métricas. No publico para validación.
Publico para externalizar conocimiento operativo.
Aquí hay: iteraciones, fallos, sistemas parciales, experimentos vivos.
Si te sirve, úsalo. Si lo puedes mejorar, contribuye.

_{Operador. Construyo en público. descambiado = fuera del patrón esperado.}

 .m ] 'T .` `]., m, .., .., m, ] m, ] ]`] ' ] ]`] ]`] ]`] ] ] ' ] ] ] ."T ] ] ] ] ]"" ] "\ \m`] ] 'mT ] ] ] ] 'b/ 'm 'm/ 

WEB · SOTYHUB · BLOG · DISCORD · YOUTUBE · GITHUB

═══════════════════════════════════

descambiado != broken · descambiado == out of pattern

David Hernández · @descambiado · operator · live · 2026