DFIR
Incident Response
WSL Backdoor
MITRE ATT&CK
CVE-2024-3400
Case Study
Upstyle Backdoor - Incident Response Report
Incident Responder / Forensic Analyst - Security Blue Team Labs
Full forensic reconstruction of a simulated multi-stage intrusion triggered by a "black screen" alert. Initial access via RDP brute-force (NTLM, Logon Type 10). Post-compromise chain included: AsyncRAT dropper deployed to %TEMP%, PowerShell enumeration bypass (-ExecutionPolicy Bypass), credential harvesting via WebBrowserPassView, lateral movement using Credential Manager (Event ID 5379), and WSL-based fileless persistence via a malicious Python .pth file inside the Ubuntu distribution. AnyDesk used for persistent remote access with auto-start on boot. Full attack timeline reconstructed from Event Logs, MFT records, Prefetch artefacts, PowerShell logs, and browser history. Backdoor identified as Upstyle (CVSS 10.0, CVE-2024-3400, MITRE S1164).
Full attack chain reconstructed: Initial Access - Persistence - Credential Access - Lateral Movement - C2
T1078 - T1059.001 - T1057 - T1555.003 - T1021 - T1547 - T1620 - T1070 - T1486
Purple Team Lab
Detection Engineering
SIEM
PurpleLab - Adversary Simulation Platform
SOC Analyst · Home Lab · Docker/VMware
Designed and built a three-VM purple team home lab integrating Elastic Stack SIEM, Windows detonation sandbox, and a DFIR VM running Caldera and Velociraptor. Implemented idempotent provisioning scripts, .env-based secrets management, ILM retention policies, and full Velociraptor agent deployment guides.
Full-stack adversary emulation pipeline with automated detection validation
Malware Analysis
Reverse Engineering
CTF
Go-Based Stealer Binary Analysis (MaskGram/Go2bypass)
CTF · Malware RE · Go / x64 PE
Deep static analysis of a 64-bit Go PE binary from the Go2bypass framework. Extracted PE sections, parsed Go pclntab function tables, and decrypted staged payloads using AES-CFB and RC4. Identified Donut shellcode loader and reconstructed the RC4-obfuscated C2 configuration without executing the sample.
Full C2 config recovered via static decryption chain - no detonation required
Detection Engineering
Splunk
MITRE ATT&CK
SOC Correlation Rule Tuning & Playbook Engineering
SOC Analyst · DuskBeacon · Remote
Reduced SIEM false positives by ~30% through systematic correlation rule review, threshold baselining, and whitelist management. Rebuilt SOC playbooks aligned to MITRE ATT&CK tactics. Documented all changes against ISO/IEC 27001 controls to simplify compliance audit trails.
~30% false-positive reduction · Analyst throughput increased significantly
Professional
FlamingoLab
Docker
Flask
SIEM
FlamingoLab Appliance v5 - SOC Operations Platform
Personal Project · Ubuntu 22.04 · Docker 28
Containerised cybersecurity operations platform integrating Splunk, Elasticsearch/Kibana, Ollama (local LLM), Velociraptor, and a custom Flask web UI. Audited and hardened the full codebase - fixing logic bugs, broken template field access, CSS regressions, and SIEM-conditional display errors.
Production-ready SOC appliance deployable on a single Ubuntu host
CTF
Threat Hunting
Forensics
Security BlueTeam Frostbyte CTF 2025 - 1st Place
CTF · Security BlueTeam · Global Competition
Achieved 1st place globally in the Security BlueTeam Frostbyte CTF 2025 - a blue team-focused competition covering incident analysis, log forensics, threat hunting, and DFIR investigation across realistic enterprise scenarios.
🥇 1st place globally - Security BlueTeam Frostbyte 2025
Competition
CTF
HTB
Malware
HTB Holmes CTF - Top 0.3% Finish
CTF · Hack The Box · 11,342 teams
Ranked 24th out of 11,342 teams in the Hack The Box Holmes CTF (2025), placing in the top 0.3% globally. Challenges covered forensics, reverse engineering, malware analysis, web exploitation, and blue team scenarios under time pressure.
Top 0.3% globally · 24th / 11,342 teams
Competition