DFIR
Evidence-led digital forensics and incident response across complex environments.
forensic_analysis.exeField research portfolio
Ahmed Elessaway / xElessaway
Investigating the digital underground.
DFIR, OSINT, and threat intelligence research - turning scattered evidence into practical analysis.
Core competencies
Research, not noise.
OSINT
Open-source investigation, infrastructure pivots, and identity research.
sources to contextThreat Intel
Actionable reporting on campaigns, adversary tradecraft, and defensive signals.
research in progressField notes
Latest research
dPhish Final Phase CTF Writeup
A practical walkthrough of dPhish Final Phase CTF, tracing a phishing campaign from a compromised internal mailbox through attacker infrastructure, malicious PowerShell attachment analysis, and the final flag.
Dissecting Exposed Adaptix C2 and Rogue MySQL Exploitation Infrastructure
In-depth forensic review of an exposed threat staging server running AdaptixC2, Cobalt Strike 4.9.1, and weaponized Rogue MySQL arbitrary file read attacks.
Imikom Agent: Analyzing GitHub and Google Sheets Cloud Dead-Drop C2 Tradecraft
Technical teardown of a sophisticated C-based malware development pipeline featuring GitHub Contents API and Google Sheets C2 channels, BYOVD EDR blinding, and process hollowing.
Practice lab
Build analyst instincts through hands-on challenges.
Explore structured OSINT and DFIR practice collections, with repeatable scenarios and clear solving paths.
Open practice lab