From Splunk to Sigma: Building and Validating Vendor-Neutral Detection Logic
A detection-engineering exercise using Sigma, Splunk, Windows telemetry, and Atomic Red Team to validate vendor-neutral detection logic
CITADEL CYBERSEC
Exploring cybersecurity incidents through structured SOC investigations.
From Manual Testing to Repeatable Detection Validation with Atomic Red Team
How to Validate PowerShell Detections in Splunk with Sysmon, Atomic Red Team, and MITRE ATT&CK
Building a Tier 1 SOC Dashboard in Splunk
Designing an Operational Monitoring Dashboard for Authentication, Endpoint, Network, and Threat Hunting Visibility
Investigating Lateral Movement and Authentication Activity in Active Directory Using Splunk
Correlating failed logons, Kerberos authentication events, SMB access, and blocked lateral movement attempts in a hardened Active Directory environment
Investigating Suspicious PowerShell Activity with Splunk
Simulating common PowerShell abuse techniques and investigating endpoint telemetry in Splunk
6 Real Problems I Solved While Building My SOC Homelab
Root Cause Analysis, Fixes and Lessons Learned During My SOC Homelab Deployment
SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
SOC Alert: Conti Ransomware Investigation
Simulating Real-World SOC Triage, Threat Hunting, and Incident Reporting Through a Conti Ransomware Investigation
Investigating a Phishing Attack with Volatility and Olevba | TryHackMe Boogeyman 2
A hands-on DFIR walkthrough covering phishing analysis, malicious macros, memory forensics, C2 investigation, and persistence detection.
Unraveling a Ransomware Attack Chain: TryHackMe First Shift CTF — Task 8: Promotion Night
Hands-on Splunk investigation covering ransomware deployment, persistence mechanisms, lateral movement, and AWS data exfiltration
Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques
Splunk 2 TryHackMe Writeup (Part 2) — BOTS v2 SOC Investigation (300 & 400 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
Splunk 2 TryHackMe Writeup (Part 1) — BOTS v2 SOC Investigation (100 & 200 Series)
Practical Log Analysis from the Boss of the SOC (BOTS v2) Dataset
TryHackMe ShadowTrace Walkthrough: Malware Analysis and IOC Extraction
Complete writeup with binary analysis, string decoding, and DFIR techniques
From Splunk to Sigma: Building and Validating Vendor-Neutral Detection Logic
A detection-engineering exercise using Sigma, Splunk, Windows telemetry, and Atomic Red Team to validate vendor-neutral detection logic
From Manual Testing to Repeatable Detection Validation with Atomic Red Team
How to Validate PowerShell Detections in Splunk with Sysmon, Atomic Red Team, and MITRE ATT&CK
TryHackMe SOC Level 2: What Changed, and What It Says About the Future of the SOC Analyst Role
Exploring the new skills, technologies and investigative mindset behind TryHackMe's updated L2 curriculum
Beyond AI Security: Learning How to Assess AI Systems
My Experience with INE’s AI Systems Security Specialist (eAIS) Learning Path
AI Security: Cybersecurity Applied to a New Attack Surface
A reflection on completing TryHackMe’s AI Security learning path