I’m a security engineer in London. I work across red team operations, adversary emulation and threat simulation, following attack paths through identity, endpoints, applications and hybrid infrastructure.

Over the past decade I’ve led red and purple team engagements, developed offensive tooling and worked with defenders to turn attack paths into useful detections and remediation. I’m particularly interested in initial-access routes that do not depend on phishing.

Two tools grew out of review work I kept doing by hand:

• attack-path-review takes a user-supplied identity or trust graph and finds bounded attack routes, shared choke points, a minimum edge cut, and the control changes with the largest modeled effect. It runs offline and writes JSON, HTML, DOT and SARIF.
• threat-sim-preflight checks a threat-simulation plan before execution: authorization, scope, windows, action dependencies, telemetry, detection coverage, cleanup and expiring waivers. It can also validate technique IDs against a local ATT&CK STIX bundle.

Selected public work:

• Five CVE records, including an access-control bypass in SolarWinds Web Help Desk
• Named in Bugcrowd’s Q3 2020 P1 Warriors
• Acknowledged through the Google Bug Hunters programme
• Named by Esri’s responsible-disclosure programme
• GCPN, OSEP, OSCP and OSWP issuer records, plus issuer records for CRTO and eWPTX

Elsewhere:

• Website: moaaztaha.com
• Email: moaaz@moaaztaha.com
• Public research: moaaztaha.com/research
• Bugcrowd: MoaazTaha
• LinkedIn: moaaz-taha