Research / Transparent synthetic case studies
See the evidence, limitations and handoff—not just the finding.
Two original threat-analysis exercises using sample data, reproducible detection rules and documented findings.
Case study 01 / Defensive telemetry
A detection that works—but misses the next persistence path.
Objective: test three simple detection predicates against eight labeled, non-operational endpoint events.
Test boundary and evidence
Eight synthetic process, autorun and network records. Three defined rules: encoded PowerShell, autostart from a Temp path, and a reserved fictional threat domain. Ground truth is author-supplied. The input is published in the source file; no real endpoint telemetry was collected.
Observed result
3
True positives
1
False positives
1
False negatives
3
True negatives
Precision and recall both 75% on this fabricated fixture only.
Decision and handoff
The encoded-command rule flags legitimate administration; the Temp-only persistence rule misses one simulated threat. Recommended next steps: attach process lineage, signed-binary context, approved baselines and negative tests before production deployment. No efficacy claim beyond this fixture.
Case study 02 / Mobile security
Suspicious permission patterns require context.
Objective: produce actionable review questions from a harmless Android-style manifest model without equating permissions with malicious behavior.
Test boundary
A fictional finance app requests SMS and boot privileges, has an exported receiver and permits backups. No APK, user data, device exploitation, runtime sandbox or live app is involved.
Four review observations
- SMS permission: validate user need, consent and data handling.
- Exported receiver: inspect access controls and caller validation.
- App backup permitted: review sensitive-data exclusion and device backup policy.
- Boot receiver: investigate persistence purpose and actual runtime behavior.
Acceptance plan
Confirm product permission necessity, inspect exported receiver authorization, verify backup exclusions and test actual boot-time execution with an approved build and device. A permission checklist alone cannot establish malware intent or platform exploitation.
What these studies demonstrate
Explainable, reproducible engineering judgment.
We can show how a hypothetical assessment is scoped, why a detection misfires, what evidence supports a finding and which next test would reduce uncertainty. Real government/defense engagements require validated personnel, actual authorized evidence, approved lab infrastructure, export screening and contract-specific handling controls.
Review scoped defensive engagement packages