// Projects
A wide range of security work, built and documented from scratch: AI red teaming, threat research, detection engineering, and homelab infrastructure.
Active Projects
AeroLab v2: Purple Team Home Lab
A full rebuild of the original AeroLab across two physical nodes with segmented networks and a complete detection stack. Elastic SIEM 9.x ingests Sysmon events from a Windows Server 2022 domain controller populated with realistic misconfigurations via BadBlood. Velociraptor handles live endpoint forensics, MITRE Caldera runs ATT&CK-mapped adversary emulations including Kerberoasting, AS-REP roasting, Pass-the-Hash, and DCSync, and Kali handles manual offensive work from an isolated segment. The red team network can reach production for attack simulations but has no path to the security segment.
Read technical writeup →Local LLM & RAG Stack
A private LLM stack that runs entirely on one laptop, with no cloud inference and nothing exposed to the network. Ollama serves Mistral Small 24B and Mistral Nemo 12B, each tuned to the largest context that stays fully resident on a 16 GB card. A retrieval layer built on mxbai embeddings and a file-backed vector index answers over my own security writeups, routing between the two models by query load. I fine-tuned the 12B on my own articles with QLoRA in Unsloth so it drafts in my writing voice, running as aero-voice:12b. A self-hosted SearXNG layer adds local web search, keeping live results clearly separated from my trusted sources. Full writeup coming soon.
// Honeypot Telemetry
github.com/Aeronique/honeypot-threat-research →Top source networks
Most-probed ports
Top CVEs
Network and country attribution reflects where source IPs are registered, often cloud or hosting infrastructure, not operator location.
Completed Projects
llm-redteam-mcp
A Model Context Protocol server I built to test my own local models before wiring any of them into an agent. It sends adversarial prompts across four categories: prompt injection, jailbreak, system prompt leak, and data exfiltration, then scores each response. The scorer reads two signals: a refusal, or a fail marker like a planted canary token that proves a guardrail was bypassed. A fail marker outranks a refusal, since a model will sometimes refuse and then leak in the same breath. It only talks to a local Ollama endpoint, so every test is repeatable and nothing leaves the lab. Backed by 47 passing tests, with new probes added as YAML whenever I find a tactic worth pinning down.
Explore the project on GitHub →Read technical writeup →
Ghidra Function ID Pipeline
A repeatable pipeline that generates Ghidra Function ID databases for glibc across four Ubuntu releases, covering 29,578 functions. Run against a stripped, statically linked test binary, it raised the number of named functions from 7 to 144.
Explore the project on GitHub →Read technical writeup →
Cloud Threat Intelligence Honeypot
Deployed T-Pot honeypot on Google Cloud Platform and left it exposed to the internet for 28 days, capturing 96 million events. Analyzed adversary TTPs from real-world threat actors, documented CVE exploitation patterns, correlated indicators of compromise with threat intelligence feeds, and published a 16-report research series on the findings.
Explore the project on GitHub →Read the research reports →
GCIH Incident Handler Certification
Completed hands-on study for GIAC Certified Incident Handler certification through SANS SEC504 coursework, practicing incident response procedures, malware analysis, and forensic investigation techniques in lab environments. Passed the GCIH exam in February 2026 with a 98%.
NetworkChuck Summer of CCNA
A structured 4-month self-guided program working through the full Cisco CCNA 200-301 curriculum. Weekly video and ebook lessons cover networking fundamentals, IP addressing, routing protocols, switching, and network security concepts. Hands-on labs use Cisco IOS in-browser environments to reinforce configuration skills alongside practice exams mapped to the certification objectives.
AeroLab: Cybersecurity Homelab
Clustered Proxmox infrastructure built for blue team operations and threat detection. Runs Wazuh SIEM for log analysis, Suricata IDS for network monitoring, Windows Active Directory for enterprise simulation, and containerized vulnerable applications for security testing.
Read technical writeup →AeroX ERC-20 Token
Built and deployed a cryptocurrency token on Ethereum's Sepolia testnet to understand blockchain security from the ground up. Explored smart contract vulnerabilities, transaction security, and the fundamentals of decentralized systems through hands-on development with Solidity and Hardhat.
Read technical writeup →