Active Directory attack simulation demonstrating LDAP/SMB enumeration, credential harvesting, lateral movement, Kerberos abuse, Resource-Based Constrained Delegation (RBCD), and Domain Administrator privilege escalation in a TryHackMe lab.

Red Team / Adversary Emulation Reference — Full ATT&CK kill chain mapper & TTP flows

Personal SOC lab using T-Pot CE on AWS to analyze real-world attack telemetry through Honeypots, Suricata, and offline log analysis

Blue Team / Defensive Security Reference — Full ATT&CK-aligned lifecycle mapper, workflows, tools & TTPs

Pentest Lab: Recon (Nmap) + DAST (OWASP ZAP baseline/full) against OWASP Juice Shop with reproducible HTML/TXT/PNG evidence and optional SOC correlation.

Practical SOC detection engineering and incident response case studies, including SIEM/XDR detections, alert triage, and malware analysis.

Governance-focused incident response framework aligned with NIST 800-61, operational resilience, executive reporting, and cyber risk management principles.

Machine learning project for classifying cybersecurity incidents (TP, BP, FP) using the GUIDE dataset. Includes data preprocessing, feature engineering, model benchmarking, and evaluation with macro-F1, precision, and recall. Supports SOC automation, threat detection, and enterprise security management.

Wireless Zero Trust Detection & Response lab using Python and Scapy, with deauth flood, unknown MAC, Evil Twin, beacon flood detection, trust scoring, JSON alerts, and CI.

Interactive MITRE ATT&CK attack chain visualizer built from real Atomic Red Team telemetry. Groups Sysmon/EDR events into scored process chains with confidence gating and explainable timelines—deployed on Streamlit Cloud.

AI-powered cybersecurity incident response platform built with React, FastAPI, Gemini, and MITRE ATT&CK mapping.

Multi-stage AD intrusion simulation investigated using Kansa IR framework and frequency stacking analysis. Covers 14 ATT&CK techniques across initial access, lateral movement, and 4 persistence layers.

Living off the Land LOLBins MCP Server — 59 composite tools for LOL binary intelligence across 10 catalogs (GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, LOLESXi, LOTP, LOLC2, LOFLCAB, WADComs)

Blue Team incident response and SOC investigation case studies based on Windows telemetry, Sysmon, IOC analysis and MITRE ATT&CK.

Evidence-based SOC Tier 1/2 projects: log pipelines, alert triage, detection rules, threat hunting, incident tickets, and lab writeups (Wazuh, Sysmon, Zeek, Suricata, Velociraptor).

An AI-powered SOC Analyst that analyzes Linux authentication logs using a local LLM (Llama 3.2 via Ollama), detects suspicious activities, maps threats to MITRE ATT&CK techniques, and automatically generates incident reports.

AI powered security investigation platform that correlates Elastic Security alerts into deterministic attack chains with OCSF normalization, risk scoring, grounded AI analysis, and analyst-focused incident investigations.

windows incident investigation using procmon | threat hunting | ioc extraction | mitre att&ck

SOC investigation labs covering phishing analysis, endpoint triage, Splunk queries, IOC extraction, and MITRE ATT&CK mapping.

Multi-threaded network scanner with MITRE ATT&CK T-code mapping. Built with Python raw sockets for deep packet analysis