DFIR
Evidence-led digital forensics and incident response across complex environments.
forensic_analysis.exeField research portfolio
Ahmed Elessaway / xElessaway
Investigating the digital underground.
DFIR, OSINT, and threat intelligence research - turning scattered evidence into practical analysis.
Core competencies
Research, not noise.
OSINT
Open-source investigation, infrastructure pivots, and identity research.
sources to contextThreat Intel
Actionable reporting on campaigns, adversary tradecraft, and defensive signals.
research in progressField notes
Latest research
Imikom Agent: Analyzing GitHub and Google Sheets Cloud Dead-Drop C2 Tradecraft
Technical teardown of a sophisticated C-based malware development pipeline featuring GitHub Contents API and Google Sheets C2 channels, BYOVD EDR blinding, and process hollowing.
Dissecting Exposed Adaptix C2 and Rogue MySQL Exploitation Infrastructure
In-depth forensic review of an exposed threat staging server running AdaptixC2, Cobalt Strike 4.9.1, and weaponized Rogue MySQL arbitrary file read attacks.
Exposed: QuickDAV Malware Distribution Repository and Remcos RAT Infrastructure
Passive acquisition review + offline static analysis of an exposed QuickDAV malware repository and Remcos RAT delivery infrastructure.
Practice lab
Build analyst instincts through hands-on challenges.
Explore structured OSINT and DFIR practice collections, with repeatable scenarios and clear solving paths.
Open practice lab