Purple Teaming · Active Directory · Threat Intelligence · AI/LLM Security
class OussamaSahnoun:
role = "Senior Offensive Cybersecurity Expert"
experience = "7+ years — offensive & defensive security"
background = ["Purple Team Lead", "Red Teamer", "CTI Analyst"]
sectors = ["Banking", "Aerospace (Airbus, DO-326A)"]
speaking = ["Black Hat MEA 2025, Riyadh — AI & Predictive Threat Hunting"]
cves = ["CVE-2020-12297", "CVE-2020-24454", "CVE-2020-24451"] # Intel PSIRT
certs = ["eCPPTv3", "eWPTx", "CRTP", "eWPT", "eJPT", "arcX CTI 101"]
langs = ["Python", "Bash", "PowerShell"]
motto = "Break it, prove it, help fix it — then teach the SOC to catch it next time."- 🔴 Offensive: Web, API, Infrastructure & Cloud pentesting — full Active Directory kill chain (recon → domain enum → priv esc → lateral movement → domain admin → cross-trust attacks)
- 🟣 Purple Teaming: turning Red Team findings into SIEM detection rules alongside SOC teams
- 🎯 CTI: MISP, OpenCTI, OSINT & dark web monitoring — indicators turned into reports SOC analysts can act on
- 🤖 AI/LLM Security: prompt injection, RAG pipeline attacks, agentic tool abuse, MCP surfaces, AI supply-chain risk
- 🐛 CVE research: 3 published vulnerabilities, responsibly disclosed and coordinated with Intel PSIRT
- 🌍 Languages:
EN·FR·AR
📖 I write long-form technical breakdowns on my blog — threat intel reports, ransomware deep-dives, and an ongoing AI Systems Security series.
| Project | Area | What it does |
|---|---|---|
| ThreatLens | AI + DFIR | Free AI SOC analyst for Windows/Linux logs — Groq LLaMA 3.3 + local embeddings, RAG over EVTX/log data, Streamlit UI. Presented live at Black Hat MEA 2025 |
| WinLogHunt-V1.0 | DFIR | PowerShell-based Windows Event Log (EVTX) analyzer for Blue Teams — anomaly detection for ransomware, malware & CVE exploitation indicators |
| Cicada3301 / Stormous CTI reports | Threat Intel | Full CTI deep-dives: RaaS affiliations, MITRE ATT&CK mapping, IOCs, YARA/Sigma rules |
| AI Systems Security Specialist | AI Security | Ongoing series on securing AI systems — trust boundaries, agent tool abuse, AI red teaming |
- 🗡️ CRTP — Certified Red Team Professional
- 🥇 eCPPTv3 — Expert-level Linux/Windows infrastructure & Active Directory pentesting — 2026
- ⚔️ eWPTx — Advanced Web Application Pen Tester eXtreme — 2024
- 🕵️ eWPT — Web Application Penetration Tester — 2023
- 🛡️ eJPT — Junior Penetration Tester — 2021
- 🧭 arcX Foundation — Cyber Threat Intelligence 101 — 2025
"Attack like a Red Teamer. Defend like a Blue Teamer. Think like a Purple one."
— Oussama Sahnoun