Ahmed Khan
Ahmed Khan is a cybersecurity researcher and developer focused on threat detection, command-line behavior analysis, and applied machine learning for security. He is the creator of Genos, an open-source command intelligence engine that classifies shell commands in real time and maps suspicious behavior to MITRE ATT&CK techniques.
Ahmed’s work combines security engineering, machine learning, and practical detection research. He has built systems for endpoint telemetry, Windows Event Log analysis, command-line classification, de-obfuscation, and ATT&CK technique mapping. He is also the first author of two accepted IEEE AIIoT 2026 papers covering command-line classification and an open-source endpoint detection and response prototype.
His current research interests include Linux threat research, behavioral detection, adversarial command analysis, endpoint security, and building practical tools that help defenders understand attacker behavior more clearly.
Session
Command-line activity is one of the clearest places where attacker behavior shows up, but interpreting it correctly is not always simple. A single command can be obviously malicious, completely benign, or only suspicious depending on context.
This talk goes over the design and development of Genos, an open-source command intelligence engine that classifies shell commands as benign, malicious, or context-dependent, while also mapping malicious behavior to MITRE ATT&CK techniques.
We will look at why command-line detection is difficult, how attackers use obfuscation and living-off-the-land binaries, and how Genos combines de-obfuscation, machine learning, and rule-based security logic to make real-time decisions. The talk will also cover lessons learned from building the system, including dataset problems, false positives, technique-mapping challenges, and the gap between a research prototype and something defenders can actually use.