Sheldon NomanNasirMinhas

Break the abstraction. Emulate the adversary. Harden what's left. Kernel-space when it has to be · forests when they let me in.

`boot sequence`

noman@psiberus-lab:~$ ./whoami --verbose
[*] resolving operator identity ................ OK
[*] loading evasion + injection modules ........ OK
[*] mounting AD attack + kernel toolkits ....... OK

uid=0(root) gid=0(root) groups=0(root),1337(red-team),31337(elite)
Linux psiberus-lab 6.x.x-hardened #1 SMP PREEMPT x86_64 GNU/Linux

OPERATOR  : Noman Nasir Minhas          ALIAS : Sheldon / malicious_dll
ROLE      : Security Engineer — Offensive Ops & Adversary Emulation
ORG       : Cytomate Solutions & Services — Doha, Qatar
FOUNDER   : Psiberus LLC — Autonomous Adversary Simulation Platform
EDUCATION : MS Cybersecurity — Air University · IEEE Published
STATUS    : ACTIVE — CRTO ✔  CRTL ✔  [Red Team Operator + Lead]

☠️ THREAT ACTOR PROFILE

╔═══════════════════════════════════════════════════════════════╗
║ CLASSIFICATION: [TOP SECRET // OFFSEC // RED CELL]            ║
╠═══════════════════════════════════════════════════════════════╣
║ OPERATOR  : Noman Nasir Minhas                                ║
║ HANDLE    : Sheldon / malicious_dll                           ║
║ MISSION   : Break. Emulate. Detect. Harden. Repeat.           ║
║ THEATER   : Windows Internals · AD · EDR · Post-Exploitation  ║
║ WEAPONS   : Rust · Go · C/C++ · C# · Python · ASM             ║
║ LAB ENV   : VMware/Hyper-V · AD Forest · ELK · MDE · Sysmon   ║
║ INTEL ORG : Cytomate Solutions — Adversary Emulation Division ║
║ FOUNDER   : Psiberus LLC — Autonomous Adversary Sim Platform  ║
║ CERTS     : CRTO (Operator) + CRTL (Lead) — Zero-Point Sec    ║
║ OFF-HOURS : quantum computing + physics — self-study, for fun ║
╚═══════════════════════════════════════════════════════════════╝

Most operators stop at the exploit. I keep going — down into kernel objects, callback tables, and the telemetry that's supposed to catch me. Break it, emulate it, then help the blue side see it coming.

🎯 CURRENT OPS

noman@psiberus-lab:~$ cat /var/log/active_ops.log
[+] ADVERSARY SIMULATION  — Full-scope red team engagements @ Cytomate.
                            MITRE ATT&CK-mapped campaigns, purple team
                            pipelines, ASL-driven scenario automation
[+] KERNEL DRIVERS DEV    — Windows kernel driver research in Rust (WDK).
                            EDR/AV internals, DKOM, callback manipulation
                            minifilter drivers, object/handle hooking
[+] AD SECURITY RESEARCH  — Cross-domain / forest trust attack chains,
                            Kerberos delegation abuse, ExtraSids golden
                            ticket forgery, DCSync, BloodHound pathing
[+] POST-QUANTUM CRYPTO   — Kyber-768 / Dilithium3 protocol integration,
                            quantum-safe secure channel design + PQC
                            migration tooling for offensive/defensive use
[+] EDR EVASION R&D       — AMSI heap corruption (HAMSICONTEXT), ETW
                            patching, patchless syscall techniques, DLL
                            call tracing via Frida, hook evasion research
[+] PSIBERUS PLATFORM     — Rust+Go+Tauri autonomous adversary sim suite.
                            MQTT/RabbitMQ C2 backend, ELK/MDE telemetry

🛠️ ARSENAL — TOOLING & TRADECRAFT

⚙️ Offensive Tooling (click to expand)

Windows Evasion & Injection

AMSI Bypass: Heap corruption via HAMSICONTEXT, patchless ntdll-level techniques, ETW patching
DLL Unhooking: Section remapping, fresh ntdll load, manual syscall resolution
Process Injection: Fork-chain injection (Go), APC injection, thread hijack, shellcode fluctuation (Rust)
Module Stomping: dinvoke_rs-powered stomping with in-memory PE manipulation
Loaders: AES-256-CBC/CTR shellcode encryption/decryption; Zig-based loader with runtime decryption
Frida Tracing: Cross-DLL call chain visibility with full forwarding chain resolution

Active Directory Tradecraft

Kerberoasting / ASREPRoasting via Impacket / Rubeus
Golden Ticket Forgery: ExtraSids field manipulation for cross-domain trust attacks (child → parent)
DCSync / SecretsDump: Credential harvesting from domain controllers
BloodHound: Graph-based attack path enumeration
Forest Trust Pivoting: Inter-forest lateral movement (CONTOSO ↔ ENCLAVE)
Constrained Delegation Abuse: S4U2self / S4U2proxy exploitation

Network & Protocol Attacks

ARP Poisoning (ARP-Puker): Gratuitous ARP MITM at Layer 2
NTLMv1/v2 Capture: Inveigh / Responder relay chains
WPAD / Proxy Abuse: Transparent traffic interception
TLS Fingerprinting: JA3/JA3S analysis via Zeek

🦀 Languages & Runtimes

Language     | Proficiency  | Primary Use
─────────────────────────────────────────────────────────────
Rust         | ████████████ | Implants, drivers, ARP tooling, C2 agents
Go           | ████████████ | Microservices, C2 runners, network tools, loaders
C / C++      | ███████████░ | Malware internals, WinAPI, kernel research
C#           | █████████░░░ | .NET post-exploitation, Cobalt Strike BOFs
Python       | ████████████ | Automation, Impacket, tooling scripts
x86/x64 ASM  | ████████░░░░ | Shellcode, syscall stubs, manual trampolines
PowerShell   | █████████░░░ | AD recon, living-off-the-land
Zig          | ███████░░░░░ | Shellcode loaders, cross-compilation experiments

🔧 Tools & Frameworks

Category	Tools
C2 Frameworks	Cobalt Strike, custom MQTT/RabbitMQ C2 (Psiberus)
RE / Analysis	IDA Pro, Ghidra, x64dbg, Frida, Volatility
Network	Wireshark, Zeek, Suricata, Nmap, Inveigh, Responder
AD Attacks	BloodHound, Impacket, CrackMapExec, Mimikatz, Rubeus
Web	Burp Suite, sqlmap, ffuf
Vuln Scanning	OpenSCAP, Lynis, CVE Binary Tool (air-gapped)
EDR/SIEM	MDE, Sysmon, ELK Stack, custom ETW consumers
Crypto	Kyber/Dilithium (PQC), AES-256 CTR/CBC, C2PA

🔬 RESEARCH DOMAINS

┌───────────────────────────────────────────────────────────────┐
│ DOMAIN                  CURRENT FOCUS                         │
├───────────────────────────────────────────────────────────────┤
│ Windows Evasion         AMSI/ETW internals, heap corruption,  │
│                         patchless bypasses, call-stack spoof  │
│ Active Directory        Cross-domain / forest trust attacks,  │
│                         ExtraSids golden ticket, Kerberos     │
│ EDR Research            Telemetry blind spots, hook evasion,  │
│                         MDE signal analysis, DLL tracing      │
│ Post-Quantum Crypto     Kyber-768, Dilithium3, secure-channel │
│                         design, PQC migration tooling         │
│ Adversary Emulation     MITRE ATT&CK mapping, ASL framework,  │
│                         automated purple-team pipelines       │
└───────────────────────────────────────────────────────────────┘

📦 REPOSITORY INDEX

Repo	Lang	TTP / Purpose
Offensive-Rust	🦀 Rust	C2 server · local/remote shellcode injection · WinAPI bindings
Offensive-Go	🐹 Go	GoShark (packet capture UI) · NetworkMonitor passive listener
Rust-Driver-Clone	🦀 Rust	Windows kernel driver (WDK) — EDR/AV internals research
ARP-Puker	🦀 Rust	Gratuitous ARP poisoning · Layer-2 MITM packet interception
binary-to-shellcode	🔧 Multi	PE → PIC shellcode conversion with encryption support
CPP-Utils	⚙️ C++	Utility library for malware/offensive tooling (MSVC)
Pentesting-Notes	📝 —	AD attack mindmaps · pentest cheatsheets · CherryTree notes
Qiskit-Quantum	🐍 Python	Qiskit notebooks — quantum computing (personal study)

Private / WIP: Psiberus agent (Rust) · Zig shellcode loader · Go fork-chain injector · Rust fluctuation implant · ASL JSON generator · sandbox/VM detection toolkit

🏗️ PSIBERUS — AUTONOMOUS ADVERSARY SIM PLATFORM

psiberus@lab:~$ cat /opt/psiberus/README
PSIBERUS — Autonomous AI-Driven Penetration Testing Platform
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
STACK:
  Agent       → Rust (evasion-first, modular payload)
  Operator UI → Tauri + Svelte (desktop)
  C2 Backend  → Go microservices, MQTT/RabbitMQ transport
  Telemetry   → ELK + MDE + Sysmon correlation engine
  Emulation   → MITRE ATT&CK mapped, ASL-native scenario engine
STATUS: [PRIVATE ALPHA] — Founder: Psiberus LLC, Doha QA

📊 OPERATIONAL STATS

✍️ INTEL DUMP — WRITING & TALKS

📡 Medium @malicious-dll — Loader design, ETW/AMSI internals, token manipulation, memory forensics, AD attack/defense
🔬 IEEE Research — Published peer-reviewed offensive security research
🧠 Instagram — Casual science communication on the side (physics, quantum, space) — a hobby, not a day job

🧪 CERTIFICATIONS & LABS

📡 ESTABLISH CONNECTION

noman@psiberus-lab:~$ netstat --contact
PROTOCOL   ENDPOINT                               STATUS
EMAIL    → contact.nomanminhas@gmail.com         OPEN
TWITTER  → @malicious_dll                        LISTENING
LINKEDIN → /in/noman-nasir-minhas                AUTHENTICATED
MEDIUM   → @malicious-dll                        PUBLISHING
GITHUB   → /NomanNasirMinhas                     PUBLIC
TOPICS: GoLang · Rust · C2 Dev · EDR Evasion · AD Attacks
        Post-Quantum Crypto · Exploit Dev · Red/Purple Ops

"The best defense is understanding how the offense thinks."

🦂 Malware Researcher · Exploit Developer · Kernel Tinkerer · Red/Purple Team Lead

All offensive research conducted in controlled lab environments for ethical R&D and defense purposes.

Navigation Menu