Defense is where fragments become a timeline. A thorough understanding of how to protect a system is invaluable when learning how to take it apart. That moment when an alert, a process tree, a packet capture, and a user action stop looking unrelated and begin explaining one another is where the riveting hunt begins.

Most of this work begins with an anomaly, then follows it across logs, endpoints, network traffic, identity, and cloud infrastructure. These investigations do not always have a true endpoint, but there is deep value in determining what happened, what it affected, how the environment changed, and which controls can prevent the same path from opening again.

Detection Engineering and Security Tooling

Hayabusa MCP

Hayabusa MCP v0.1.0 is a security-hardened Python MCP server for controlled EVTX analysis with Hayabusa 3.10.0. It runs the scanner through a dedicated non-login service identity with a fixed executable, working directory, argument structure, and allowlisted environment. Path containment, symlink rejection, isolated per-scan workspaces, bounded output, process-group timeouts, and sanitized failures restrict what an MCP client can ask the system to do.

The release completed a real MCP initialization and tool call against an EVTX sample, returned a genuine finding, passed Ruff and 52 tests, and was tagged, snapshotted, and documented for recovery.

Hayabusa MCP terminal showing Ruff checks passing, 52 tests passing, deployment documentation committed, and a clean Git worktree

Release validation: Ruff clean, 52 tests passed, deployment documentation committed, and a clean worktree.

AISMON

I built aismon to detect AI-related activity in Windows Sysmon Event ID 1 data. The Python CLI evaluates events against 35 YAML rules across seven behavior categories. Secure XML parsing, API-key redaction, schema validation, false-positive coverage, and automated multi-version testing are part of the design. The release passed 69 tests.

AISMON JSON output showing redacted identity data, Windows process context, SHA-256 hash, and a low-severity AI vendor API detection

Corrected AI-025 output preserves process context, hashing, credential redaction, and calibrated detection metadata.

Honeypot Operations

RedTail, Party of Seven

One Cowrie SSH session delivered five RedTail ELF binaries compiled for different CPU architectures, plus setup.sh and clean.sh. Part I covers what landed, how the scripts operate, and why this looks like an automated cryptomining deployment.

Splunk Honeypot Dashboard showing recent Cowrie activity

Security Operations

Internal Honeypot and Log Analysis

honeypot01 runs Cowrie on Ubuntu Server as an internal SSH honeypot. Its fake service listens on TCP/2222 and starts through an enabled systemd unit. Tests from bare-metal Kali produced connection, authentication, session, and command events in Cowrie's text and JSON logs. I exported and preserved the source logs, then used jq to isolate and review session activity.

Cowrie JSON session events displayed through jq with the source address redacted

Cowrie session data reviewed with jq; the source address is redacted.

splunk01 runs Splunk Enterprise on Ubuntu Server. Installation, startup, and web access are verified. Cowrie ingestion, Windows event forwarding, dashboards, and alerts are not represented here as completed work.

Applied SOC Investigations

TryHackMe SOC Level 1 simulations added time pressure and a queue full of alerts that did not arrive in any considerate fashion. In Phishing Unfolded, I triaged approximately 36 alerts across Elastic and Splunk, revised rejected case reports, correlated phishing activity with process execution, command-and-control traffic, and possible exfiltration, then batch-escalated the connected incident.

TryHackMe SOC Simulator progress summary showing 67 closed alerts, a three-minute mean resolution time, and a ten-minute mean dwell time

SOC Simulator performance across 67 closed alerts, with a three-minute mean resolution time and ten-minute mean dwell time.

Additional Splunk and Elastic investigations covered a successful SSH brute-force attack, scheduled-task persistence, web-shell activity, ProxyLogon exploitation, backdoor account creation, PowerShell discovery, and archive staging that did not generate its own alert. Phishing and network-traffic labs added header and attachment analysis, IOC extraction, sandbox-report review, ARP poisoning, DNS and ICMP tunneling, cleartext protocols, TLS decryption, and host identification through DHCP, NetBIOS, and Kerberos traffic.

Cloud Defense

In AWS CloudShell, I investigated and remediated public exposure across security groups, route tables, subnets, and network ACLs. The work included removing unrestricted SSH and database access, replacing CIDR-based database access with a security-group reference, validating web-to-database connectivity through SSM and netcat, and confirming the remediation with the lab's Lambda verifier.

I then built segmented environments from the ground up: public and private subnets with separate route tables, security groups scoped by role, and custom stateless NACLs for each subnet. The final configurations were inspected through the AWS CLI and passed the supplied verification functions. Instance identifiers, addresses, and internal screenshots remain private.

AWS Lambda validation showing a private subnet with public IP assignment disabled and no route to an Internet Gateway

Lambda validation confirms that the private subnet does not assign public addresses and has no route to an Internet Gateway.

Threat Hunting and Incident Response

Endpoint, Host, and Network Investigations

  • Axios Supply Chain Attack: npm dependency injection, JavaScript deobfuscation, RAT analysis, T1546.004 persistence, and C2 traffic decoding
  • Masquerade: PowerShell EVTX forensics, RC4 payload decryption, .NET C2 client reverse engineering, and AES-256-CBC channel decryption
  • Honeynet Collapse: Initial Access Pot: WordPress brute-force forensics, backdoor recovery, SSH-key privilege escalation, and persistent malware identification
  • MacHunt: APFS mounting, binary plist analysis, Safari SQLite history, DHCP lease review, TCC Full Disk Access, LaunchAgent persistence, and exfiltration reconstruction
  • Port 111 Open, 48 Hours After Kenobi: masscan identified rpcbind on the Proxmox host; I traced its dependencies, disabled the service, and confirmed the port closed
  • Overpass 2: Hacked: PCAP analysis reconstructed the intrusion before I tested the backdoor the attacker left behind

Cloud and Identity Investigations

OSINT

  • Cache Me Outside: a leaked screenshot, GitHub commit metadata, an out-of-office reply, and location evidence converged on the subject's identity and location

Malware Analysis and Incident Reconstruction

The three-part Boogeyman investigation belongs to TryHackMe's SOC Level 1 path. It follows a campaign from the first phishing email through persistence, memory forensics, lateral movement, credential dumping, and domain compromise.

Part 1: Initial Access and Exfiltration

I reconstructed a phishing message in Thunderbird, inspected its malicious shortcut with LNKParse3, and parsed PowerShell logs with jq. Those artifacts exposed downloads, reconnaissance, credential access, KeePass activity, and data staging. Wireshark and TShark connected the host activity to command execution and encoded data leaving the workstation.

Boogeyman Part 1 phishing and malicious shortcut analysis

Phishing email and malicious shortcut analysis

Part 2: Memory Forensics and Persistence

A second phishing message delivered a document with a VBA macro. I used olevba and Volatility to recover the download path, process tree, command-and-control process, additional payload, and the complete scheduled-task command used for persistence.

Boogeyman Part 2 process and command-and-control artifacts recovered from memory

Process execution and command-and-control artifacts recovered from memory

Part 3: Lateral Movement and Domain Compromise

Elastic, Kibana, Sysmon, and host telemetry connected the payload to scheduled-task persistence, a UAC bypass, credential dumping, remote access, and movement across several systems. The chain ended in DCSync activity and an attempted ransomware download. The available logs did not show ransomware execution.

Boogeyman Part 3 SIEM investigation showing privilege escalation and credential dumping

Kibana results showing privilege escalation and credential dumping