Saad A.

Co-Founder

Morocco1 yr 11 mos experience

Key Highlights

Expert in Cyber Threat Emulation and EDR Evasion.
Proven track record in Malware Development and Defense Evasion.
Author of CETP with extensive training experience.

Stackforce AI infers this person is a Cybersecurity Expert specializing in Red Team operations and Malware Development.

Contact

Skills

Core Skills

Cyber Threat EmulationEdr EvasionDefense EvasionReverse EngineeringInitial Access ToolsMalware DevelopmentContent Development

Other Skills

EDR bypass developmentadvanced TTPsadversary simulationReversingDebuggingStatic Detection BypassCode VirtualizationRootkitsC2 Traffic TunnelingInitial Access frameworkmalicious Office Macro DocumentsBypass EDRContent CreationOpen source projectsOpen-Source Development

About

Cyber Threat Emulation, EDR Evasion, Malware Development, Security Researcher, R&D

Experience

Dark space security

Founder & Security Researcher

Jul 2025 – Present · 8 mos · On-site

EDR bypass development and evaluation.
Design and weaponize advanced TTPs to create stealthy artifacts for Red Team operations.
Research and emulate modern adversary techniques to support realistic adversary simulation.

EDR bypass developmentadvanced TTPsadversary simulationCyber Threat EmulationEDR Evasion

Altered security

Author Evasion Lab (CETP)

Feb 2024 – May 2025 · 1 yr 3 mos · Singapore

Reversing & Debugging EDR's Internals using WinDbg & IDA Pro.
Static Detection Bypass using obfuscators & Code Virtualization.
Reversing & Exploiting R/W primitive vulnerable drivers to Remove PPL Protection, Bypass DSE, Tamper EDR (removing kernel callbacks, disabling ETW, ...).
Reversing & Exploiting vuln Killer drivers to kill EDR's processes.
Writing Rootkits that manage PPL Protection, remove EDR kernel callbacks, disable EDR's ETW Providers, kill EDR's processes.
C2 Traffic Tunneling over trusted channels like Slack, GitHub, ...
ASR rules bypass.
Reversing & Bypassing Sysmon.
and more ...

ReversingDebuggingStatic Detection BypassCode VirtualizationRootkitsC2 Traffic Tunneling+2

Cognisys

Red Team Developer

Jun 2023 – Aug 2023 · 2 mos · Manchester Area, United Kingdom · Remote

Training Team stuff on Malware development.
Blogging & Content Creation.
Releasing Open source projects on Malware development and Evasion.

Malware developmentContent CreationOpen source projectsMalware DevelopmentContent Development

Bodyguard.io - stop targeted phishing

Red Team Developer

May 2023 – May 2024 · 1 yr · Netherlands · Remote

Creating Initial Access framework that generates malicious Office Macro Documents, MSIs, HTAs, Weaponized LNKs, PE (Exe, DLL) Loaders & droppers, Containers (ISO, Zip, ...), Backdooring signed ClickOnce, WebDav mapping.
Bypass MOTW & Smartscreen.
Bypass EDR

Initial Access frameworkmalicious Office Macro DocumentsBypass EDRInitial Access ToolsDefense Evasion