Security Lab
Real-world security projects, detection engineering, and threat hunting tools developed throughout my cybersecurity journey
MITRE ATT&CK Coverage
Detection coverage mapped to MITRE ATT&CK framework, ensuring comprehensive visibility across the attack lifecycle
PowerShell
Detection Strategy:
Monitor for encoded commands, suspicious parameters, and download cradles
Data Source:
Process Creation, Command Line
Remote Desktop Protocol
Detection Strategy:
Track RDP connections from unusual sources, multiple failed attempts
Data Source:
Network Traffic, Authentication Logs
Valid Accounts
Detection Strategy:
Monitor for unusual privilege assignments, service account usage
Data Source:
Authentication Logs, Process Creation
Data Staged
Detection Strategy:
Large file creation in unusual locations, compression activity
Data Source:
File Creation, Process Monitoring
Registry Run Keys
Detection Strategy:
Monitor registry modifications to auto-start locations
Data Source:
Windows Registry, Process Creation