Active Security Operations
6 reproducible SOC detection labs, SIEM correlation engines, and forensics toolkits.
SIEM Alert Triage Engine
Python-based alert enrichment pipeline integrating VirusTotal, AbuseIPDB, and Shodan APIs to auto-classify and reduce false positives by 60%.
Custom Sigma Detection Rules
Vendor-agnostic Sigma rules mapped to MITRE ATT&CK TTPs targeting encoded PowerShell, process injection, and credential dumping techniques.
Memory Forensics Toolkit
Volatility 3 automation scripts for rapid malware triage — detects process hollowing, reflective DLL injection, and hidden rootkit artifacts.
Windows Event Log Parser
Python & PowerShell toolkit for parsing Sysmon EID 1/3/10 and Windows Security 4624/4625 events into structured threat timelines.
IOC Enrichment Bot
Automated IOC enrichment pipeline querying MISP, VirusTotal, and AbuseIPDB feeds — outputs structured JSON reports for analyst triage queues.
Zeek & Wireshark Lab
Home lab setup capturing and analyzing east-west network traffic with Zeek scripts and Wireshark display filters for C2 beacon detection.