About

About

Wael Ghnimi aka 0xW43L

đź‘‹ About Me

Senior Cyber Threat Intelligence Analyst | Former Red Teamer & Blue Teamer | Offensive & Defensive Security Expert

With a strong foundation in both offensive security (Red Team) and defensive operations (Blue Team/SOC), I bring a dual perspective to the Cyber Threat Intelligence (CTI). My career is driven by a passion for uncovering and mitigating threats, blending deep technical expertise with strategic intelligence analysis to safeguard organizations against advanced cyber adversaries.

I thrive on complex challenges, whether it’s tracking sophisticated threat actors, developing custom security tools, or conducting deep-dive investigations into evolving attack vectors. I believe in continuous learning, research, and collaboration to stay ahead in the rapidly changing cyber threat landscape.

Certifications & Professional Achievements

  • OSEP (PEN-300) - Experienced Penetration Tester (Advanced Evasion Techniques and Breaching Defenses)
  • eWAPTx - Web application Penetration Tester eXtreme
  • CRTO - Certified Red Team Operator
  • eJPT - eLearnsecurity Junior Penetration Testing
  • arcX - Cyber Threat intelligence Analyst Foundation (101)
  • ICTTF - Ransomware Uncovered - Specialist Certificate
  • HackTheBox Prolabs: Dante

OSEP.svg ewapt.png ejpt.png

CTI101.webp pro-lab-dante.svg icttf-logo

Research, Projects & Tool Development

Purple Teaming

  • TACTFlow: Purple Teaming Framework. A public framework bridging Cyber Threat Intelligence, Red Teaming, and SOC Engineering by mapping adversary TTPs from MITRE ATT&CK to operational purple-team playbooks. Ongoing blog series walks through each tactic and sub-technique from three angles: how CTI tracks it, how Red Teams simulate it, and how SOCs detect and mitigate it. Currently releasing across the Initial Access tactic, with continuing coverage across the remaining ATT&CK lifecycle.

Penetration Testing & Red Teaming

  • LDAPHunter - LDAP Enumeration Tool. A Python tool that automates LDAP enumeration for penetration testers. Extracts users, groups, organizational units (OUs), password policies, privileged memberships, and unconstrained delegation from Active Directory. Supports anonymous and authenticated access over LDAP (389) and LDAPS/TLS (636), with multiple authentication formats.

Cyber Threat Intelligence (CTI)

  • IOCs Finder: Cyber Threat Intelligence Hub. Automated pipelines for the collection, normalization, and correlation of Indicators of Compromise across open and closed sources. Integrated with IBM QRadar for real-time threat intelligence enrichment inside the SIEM, and connected to the CrowdStrike API to push curated indicators directly into the endpoint detection stack.

Reverse Engineering (RE) & Malware Analysis (MA)

  • Qakbot Auto-Decryptor Plugin (IDA Pro). A Python plugin for IDA Pro that automates Qakbot configuration decryption and IOC / malware-config extraction. Removed the manual unpacking and string-decryption overhead from reverse engineering Qakbot samples. Integrated into the QRadar and CrowdStrike incident response workflow for automated enrichment during active campaigns.
  • CryptBot Malware Analysis Series. Three-part technical deep-dive into the CryptBot infostealer family: v1 architecture and static analysis, v2 RC4 exfiltration and NetSupport RAT delivery, v3 compiler-switch analysis and obfuscation shifts. Published on the blog.

AI & Machine Learning

  • DPTML: Dynamic Penetration Testing using Machine Learning. Academic research combining reinforcement learning with the penetration testing lifecycle to automate offensive decision-making. Automated input discovery, vulnerability indicator detection, and public-exploit matching driven by live engagement findings. Included a self-directed troubleshooting loop that let the agent adapt scripts and retry on execution failures.

Technical Expertise & Training (Learning, Research & Knowledge Base)

This section catalogs the books, courses, tools, and platforms I use to sharpen my skills and stay at the forefront of the field.

Programming

“The only way to learn a new programming language is by writing programs in it” - Brian W. Kernighan

1. C Programming

Cybersec-Beginner (Starting Point …)

Books

Reverse Engineering (RE) & Malware Analysis (MA)

Courses

Tools

Services

Malware & Exploit Development

Courses

Tools

Cyber Threat Intelligence (CTI)

Courses

Books

  • Uncertain Shield: The U.S. Intelligence System in the Throes of Reform - by Richard A. Posner (Hoover Studies in Politics, Economics, and Society)
  • Deception: The Untold Story of East-West Espionage Today - by Edward Lucas
  • Enemies of Intelligence: Knowledge and Power in American National Security - by Richard K. Betts
  • The Art of Intelligence - by Henry A. Crumpton
  • Spurious Correlations - by Tyler Vigen
  • Red Team Development and Operations: A Practical Guide - by Joe Vest
  • The US Intelligence Community - by Jeffrey T. Richelson
  • Active Measures: The Secret History of Disinformation and Political Warfare - by Thomas Rid
  • Intelligence-Driven Incident Response: Outwitting the Adversary - by Scott J. Roberts
  • Structured Analytic Techniques for Intelligence Analysis - by Richards J. Heuer Jr.
  • Psychology of Intelligence Analysis - by Richards J. Heuer Jr.
  • Threat Modeling: Designing for Security - by Adam Shostack
  • Intelligence: From Secrets to Policy 8th Edition - by Mark Lowenthal
  • Incident Response & Computer Forensics, Third Edition - by Jason T. Luttgens
  • Effective Threat Intelligence: Building and Running an Intel Team for Your Organization - by James Dietle
  • Visual Threat Intelligence: An Illustrated Guide For Threat Researcher - by Thomas Roccia
  • Permanent Record - by Edward Snowden
  • The Art of Cyberwarfare: An Investigator’s Guide to Espionage, Ransomware, and Organized Cybercrime - by Jon DiMaggio

Tools

Platforms

Frameworks

Data Feeds

Services

Vulnerability Assessment & Management

Penetration Testing

Books

Tools

EDRs (Detection and Response)

Operating Systems

Cloud Platforms

Version Control

Virtualization & Containerization

Earned Certifications InRelation W/ University

  • Fortinet - NSE 2 Network Security Associate
  • Fortinet - NSE 1 Network Security Associate
  • Microsoft - Microsoft Technology Associate: Security Fundamentals (MTA)
  • Microsoft - Microsoft Technology Associate: Networking Fundamentals (MTA)
  • Microsoft - Microsoft Technology Associate: Programming Using HTML and CSS
  • Microsoft - Microsoft Office Specialist: Microsoft Powerpoint® 2016
  • Microsoft - Microsoft Office Specialist: Microsoft Word 2016

nse2.png nse1.png mta_security.png mta_networks.png mta_html_css.png