██████╗ ███████╗██████╗ ██╗ ██████╗ ██╗ ██╗ ██╗███████╗
██╔══██╗██╔════╝██╔══██╗ ██╔╝ ██╔══██╗██║ ██║ ██║██╔════╝
██████╔╝█████╗ ██║ ██║ ██╔╝ ██████╔╝██║ ██║ ██║█████╗
██╔══██╗██╔══╝ ██║ ██║ ██╔╝ ██╔══██╗██║ ██║ ██║██╔══╝
██║ ██║███████╗██████╔╝██╔╝ ██████╔╝███████╗╚██████╔╝███████╗
╚═╝ ╚═╝╚══════╝╚═════╝ ╚═╝ ╚═════╝ ╚══════╝ ╚═════╝ ╚══════╝
"I attack like a Red Teamer. I defend like a Blue Teamer. I think like both."
name: Faisal Mehmood
alias: cipheread
role: Security Operations Engineer
speciality: Red + Blue Team Operations · DevSecOps · Incident Response
mindset: Adversary-informed defense — I break things to learn how to fix them
current: Enhancing detection logic, SIEM use cases, and VAPT lifecycles
learning: Adversary emulation (MITRE ATT&CK), purple teaming, CI/CD securityI operate on both sides of the security divide — running offensive assessments as a Red Teamer to uncover real attack paths, then switching context to Blue Team operations to build the detections that catch them. My SOC work is shaped by attacker thinking: every alert I tune, every SIEM rule I write, every incident I respond to is informed by how an adversary would actually behave in the environment.
What I do on the Red side:
|
What I do on the Blue side:
|
RED ──┬── OSINT gathering [ Maltego · Shodan · theHarvester ] T1589/T1590
└── Network scanning [ Nmap · Masscan · Censys ] T1046
BLUE ──┬── Attack surface mgmt [ Shodan Monitor · GreyNoise ] Detect T1590
└── Honeypot alerting [ OpenCanary · Canarytokens ] Detect T1046
RED ──┬── Spear phishing [ GoPhish · EvilGinx2 ] T1566.001/002
└── Exploit public apps [ Metasploit · Burp Suite ] T1190
BLUE ──┬── Email security gateway [ Proofpoint · M365 Defender ] Detect T1566
└── Patch management [ Tenable · Qualys ] Detect T1190
RED ──┬── Living-off-the-land [ PowerShell · WMI · mshta ] T1059/T1218
└── Macro / script exec [ Empire · Sliver · Cobalt Strike ] T1059.001
BLUE ──┬── Script block logging [ Windows Event 4104 · AMSI ] Detect T1059
└── Application allowlist [ AppLocker · WDAC ] Detect T1218
RED ──┬── Registry Run keys [ Reg.exe · PowerShell ] T1547.001
└── Scheduled tasks [ schtasks · Cron ] T1053
BLUE ──┬── Registry monitoring [ Sysmon Event 13 · Sentinel ] Detect T1547
└── Task / cron auditing [ Velociraptor · OSQuery ] Detect T1053
RED ──┬── Token impersonation [ Incognito · Cobalt Strike ] T1134
└── Kernel exploitation [ PrintNightmare · CVE drivers ] T1068
BLUE ──┬── Privileged access mgmt [ CyberArk · HashiCorp Vault ] Detect T1134
└── EDR kernel protection [ CrowdStrike · SentinelOne ] Detect T1068
RED ──┬── Pass-the-Hash/Ticket [ Mimikatz · Rubeus · Impacket ] T1550.002
└── RDP / SMB pivoting [ Impacket · Chisel ] T1021.001
BLUE ──┬── Network segmentation [ VLAN · Firewall ACLs · Zero Trust ] Detect T1021
└── Credential Guard [ Windows Credential Guard ] Detect T1550
RED ──┬── C2 exfil over DNS [ DNScat2 · Cobalt Strike ] T1071.004/T1048
└── Cloud storage abuse [ rclone · aws s3 cp ] T1567.002
BLUE ──┬── DNS traffic analysis [ Zeek · Umbrella · Sentinel ] Detect T1071.004
└── DLP + CASB [ Purview · Netskope · ZScaler ] Detect T1567
|
|
╔══════════════════════════════════════════════════════════════════╗
║ 🟣 PURPLE TEAM — WHERE I BRIDGE BOTH ║
╠══════════════════════════════════════════════════════════════════╣
║ ║
║ Red findings ──► Blue detection rules ║
║ Attack paths ──► Threat hunt playbooks ║
║ TTP simulation ──► SIEM use case development ║
║ Evasion tests ──► EDR tuning and gap closure ║
║ MITRE ATT&CK ──► Control validation mapping ║
║ ║
║ "If Red did it and Blue didn't catch it — I fix both sides." ║
║ ║
╚══════════════════════════════════════════════════════════════════╝
Purple Team activities I run:
- Joint adversary simulation with detection feedback loops
- MITRE ATT&CK coverage mapping against existing controls
- Detection gap analysis post-Red Team engagement
- SIEM rule tuning based on attacker evasion techniques observed in the field
- Threat hunting from Red Team TTP playbooks
drwxr-xr-x OFFENSIVE
├── [CEH] Certified Ethical Hacker — EC-Council
└── [CRTA] Certified Red Team Analyst — TCM Security
drwxr-xr-x DEFENSIVE
├── [SOC101] SOC Fundamentals — TCM Security
├── [SOC202] Intermediate SOC Analysis — TCM Security
├── [PWF] Practical Windows Forensics — TCM Security
└── [CPPS] Certified Phishing Prevention Specialist — TCM Security
drwxr-xr-x CLOUD & IT
├── [AWS] AWS Builders Online Series — Amazon Web Services
└── [GITS] Google IT Support Specialization — Coursera / Google
| Platform | Handle |
|---|---|
| faisalmehmood111 | |
| 🐙 GitHub | cipheread |
| cipheread@gmail.com | |
| 🔐 TryHackMe | cipheread |
| 🏴 Hack The Box | cipheread |
[ 🔴 ATTACKING · 🔵 DEFENDING · 🟣 BRIDGING THE GAP ]
"Every log tells a story — I help you read between the lines."