Threat Intelligence Research Engineer · XPLG · Tel Aviv, Israel
I turn adversary research into ATT&CK-mapped hunts, detection candidates, validation evidence, and analyst-reviewed security tooling.
Threat Intelligence Research Engineer at XPLG (enterprise security data platform). Formerly Head of Red Team - Israel Police Cyber Defence Unit. CTI-to-detection practitioner. Profiles adversary infrastructure, maps TTPs to ATT&CK-aligned detection candidates, and ships analyst tooling for CTI and reverse engineering workflows. Based in Tel Aviv, Israel.
Concise definitions for readers, search engines, and AI retrieval systems; each answer links to the supporting work.
Andrey Pautov is a Threat Intelligence Research Engineer at XPLG in Tel Aviv and a former Head of Red Team at the Israel Police Cyber Defence Unit. His work covers CTI-to-detection workflows, adversary profiling, ATT&CK mapping, malware analysis, and analyst-reviewed AI tooling.
Profile and experienceAdversaryGraph is a self-hosted CTI-to-detection workbench for turning reports, IOCs, malware findings, assets, and telemetry into ATT&CK-mapped investigations, hunting hypotheses, detection candidates, and validation evidence.
AdversaryGraph project hubCTI as Code is a version-controlled method for maintaining structured intelligence, evidence, confidence, ATT&CK mappings, and detection artifacts as reviewable files with a clear change history.
CTI as Code guideIt is the controlled path from source-rated intelligence through behavior mapping, telemetry requirements, hunting hypotheses, detection logic, lab validation, and SOC handoff. Generated suggestions remain subject to analyst review.
CTI Analyst Field ManualA purposive 111-publication corpus most often describes AI as an accelerator for familiar identity, research, evasion, and malware workflows. The 103-publication statistical denominator measures reporting coverage—not attacks, victims, prevalence, or provider abuse rates.
Read the statistical CTI studyShort on time? Pick the path that matches your role. Each route points to the strongest evidence first.
Fastest overall read of scope, depth, and evidence.
Adversary profiling, attribution, and CTI-to-detection methodology.
Validated detections, coverage matrices, and hunting content.
Reverse engineering workflows, cloud scanning, and CLI tools.
Four primary portfolio signals. Deeper domain, lab, and repository lists live on the projects page.
AI-assisted malware triage tool with PyPI release: function behavior, ATT&CK candidates, YARA seeds, IOC export, JSON, and HTML reports.
AI-assisted CTI-to-detection workbench for report and log ingestion, IOC enrichment, ATT&CK extraction, MalwareGraph-backed malware analysis, asset attack surface mapping, actor comparison, Navigator-style views, and analyst reports.
Multi-cloud AI security scanner for AWS and GCP attack simulation, CloudTrail/Cloud Audit coverage, finding classification, and remediation output.
Complete CTI-to-detection pipeline with source review, OpenCTI graph, detection atlas, and lab validation against Kibana evidence.
Six verified captures from release fixtures, reproducible labs, and published research. Each card states what the image demonstrates—and its evidence boundary.
AdversaryGraph v6 · Release capture
The v6 Discover surface exposes investigation, enrichment, ATT&CK mapping, malware analysis, asset review, simulation, and evidence paths. Sanitized release fixture; no customer telemetry.
Open platform documentation
Operation Desert Hydra · SIEM validation
Kibana preserves four events where wscript.exe launches hidden encoded PowerShell. Benign lab simulation; validates telemetry capture and query behavior, not evasion resistance.
AIDebug · Malware analysis
Function inventory, disassembly, register context, behavior summary, and ATT&CK leads stay in one analyst workflow. Illustrative release capture; analyst validation remains required.
Open screenshots and provenance
CTI as a Code · Evidence-as-code
Twelve observed techniques map to evidence, confidence, rule state, coverage gaps, and remediation. Worked fictional training investigation; the method and artifacts are reproducible.
Open full case study
Detection engineering · Applied research
The pattern joins retrieval, model, tool-call, approval, and MCP telemetry with scoring and response controls. Illustrative detection design; validate against the target schema and baseline.
Open detection methodology
Embedded systems · CTI research
The source-backed ranking turns appliances, BMCs, UEFI, shared accelerators, and debug interfaces into an action order. Analytic prioritization; confirm exposure in local inventory.
Open research and sourcesThree recent research publications and three current tools. Use Articles and Projects for the full archive.
Use the profiles below for code, writing, and professional contact.