Joseph Abidoye

Validate that a custom Sysmon configuration correctly captures core endpoint telemetry, then use that telemetry to reconstruct system activity the way a SOC analyst would during an investigation.

Microsoft Sysmon, SwiftOnSecurity config, Windows Event Viewer, Windows Server 2022

• Deployed Sysmon on a domain controller and imported a custom configuration to expand logging coverage
• Generated realistic endpoint activity process launches, DNS lookups, browsing, and file downloads to trigger each rule category
• Investigated and documented Event ID 1 (Process Create), 3 (Network Connection), 11 (File Create), and 22 (DNS Query) in Event Viewer
• Collected IOCs (process names, GUIDs, file paths, DNS queries) and built an investigation timeline and final incident report
• Mapped findings to MITRE ATT&CK (T1059, T1071, T1071.004, T1105) and NIST CSF 2.0 Detect functions

Default Windows logging misses most of what an attacker actually does on a host Sysmon's process, network, file, and DNS telemetry is what turns isolated events into a traceable chain of activity.

Simulate realistic Windows security events, investigate Security Logs for suspicious authentication and account activity, collect IOCs, and document findings using a structured SOC investigation methodology.

Windows Event Viewer, PowerShell, Nmap, NetExec (CrackMapExec), SMB tools

• Enumerated the target Windows Server from Kali Linux with Nmap and NetExec, identifying SMB (445) and WinRM (5985) exposed with SMBv1 disabled
• Investigated Event ID 4625 (failed logon) and 4624 (successful logon), correlating target account, logon type, and source information
• Traced Event ID 4720 (user account created) and 4732 (added to Administrators group), confirming a privilege escalation path
• Performed a remote SMB authentication attempt from Kali via NetExec, capturing the resulting Logon Type 3 failure with full source-IP visibility
• Built an investigation timeline, IOC report, and full incident report mapped to MITRE ATT&CK (T1078, T1098, T1110, T1136)

How to correlate network-side activity (Nmap/NetExec scans) with the exact Windows Security Log events they generate, so a SOC alert can be traced back to a concrete, attributable action rather than treated in isolation.

Validate a reported phishing URL using OSINT, collect Indicators of Compromise, and investigate the hosting infrastructure behind it.

PhishTank, VirusTotal, IPinfo, AbuseIPDB, dig, whois, curl

• Verified the domain as a confirmed phishing site via PhishTank and VirusTotal vendor detections
• Ran DNS (A/NS/MX/TXT), WHOIS, and HTTP header analysis to profile the malicious domain and its registrar
• Investigated hosting infrastructure with IPinfo and AbuseIPDB, tracing the IP to a hosting provider in Frankfurt, Germany
• Compiled IOCs and mapped findings to MITRE ATT&CK (T1566.002 Phishing: Link, T1583 Acquire Infrastructure)

How to chain passive OSINT sources into a single evidence trail from initial verification through infrastructure attribution without any direct interaction with the malicious target.

Assess a fictional fintech's web app for OWASP Top 10 vulnerabilities and produce actionable, developer-facing remediation guidance.

DVWA, Burp Suite Pro, Kali Linux

• Exploited SQL Injection with UNION-based payloads via Burp Suite, extracted and cracked password hashes
• Confirmed Reflected XSS with a JavaScript alert payload
• Built a forged HTML page to run a CSRF password-change attack with no victim interaction
• Mapped all three findings to OWASP Top 10 categories with severity ratings and code-level fixes

How trivially exploitable unvalidated input is, and why parameterized queries, output encoding, and anti-CSRF tokens are baseline controls, not extras.

Detect brute-force SSH login attempts from raw Linux authentication logs using Splunk SPL, and map findings to MITRE ATT&CK.

Splunk Enterprise 10.4.0, SPL, synthetic auth-log dataset

• Ingested 12,500+ "failed password" events from a deliberately noisy, unbalanced dataset
• Built threshold-based SPL (stats + where count > 5) to isolate brute-force IP/username pairs
• Ranked top attacking source IPs independent of targeted account, for blocklist use
• Built a 5-minute timechart to pinpoint attack burst windows (391 events in 15 minutes)

How much signal hides in noisy logs and that threshold tuning matters as much as detection logic: too low floods you with false positives, too high misses slow attacks.

Build an automated cloud breach-detection and containment pipeline using a honeytoken secret as bait.

AWS Secrets Manager, CloudTrail, CloudWatch, EventBridge, Lambda, IAM, SNS (eu-north-1)

• Planted a honeytoken secret in Secrets Manager as bait for unauthorized access
• Built two parallel detection paths CloudWatch metric filters and EventBridge event rules and compared their speed
• Wrote a Lambda kill-switch that auto-quarantines a compromised IAM user via DetachUserPolicy
• Captured a full forensic evidence chain: CloudTrail JSON logs, SNS alert emails, before/after IAM state

EventBridge reacted in under 10 seconds vs. 3-5 minutes for CloudWatch metric filters event-driven detection beats polling when response time matters, especially in banking-grade environments.

Run a full external reconnaissance and footprinting engagement against an authorized lab domain to map its real attack surface.

Amass, Recon-ng, theHarvester, WHOIS, dig, Nmap, draw.io

• Ran passive OSINT Amass, Recon-ng, theHarvester, WHOIS, dig, Google Dorking
• Ran active scanning: host discovery, full port/version scan, aggressive Nmap scan
• Uncovered Cloudflare proxying, four open TCP ports, and an SSL SAN subdomain disclosure
• Converted findings into a risk-ranked target list and a Data Flow Diagram of the attack surface

How much can be inferred about an organization's real infrastructure from public, passive sources alone and how a single SSL certificate SAN field can leak a hidden subdomain.

Design a segmented branch-office network that isolates departments and enforces least-privilege access between them.

Cisco Packet Tracer, Cisco IOS

• Segmented the network into VLANs for Admin, Sales, and IT
• Configured router-on-a-stick inter-VLAN routing with per-VLAN sub-interfaces
• Set up trunk ports between switch and router
• Wrote ACLs denying Sales access to Admin/Payroll while permitting IT full access, verified with live ping tests

VLANs alone only separate broadcast domains real access control needs ACLs layered on top, and testing with actual ping/traceroute is the only way to confirm a "deny" rule behaves as intended.

Use a SIEM to monitor a system for integrity violations and tie findings to real compliance frameworks.

Wazuh SIEM

• Verified agent connectivity and explored Security Events / System Auditing logs
• Identified a File Integrity Monitoring alert triggered by a checksum change (SHA1/SHA256 mismatch) on a monitored file
• Investigated the alert to determine likely cause and impact
• Tied the finding to compliance frameworks PCI DSS and ISO 27001

FIM alerts are only as useful as the baseline behind them you need to know which files should never change before the checksum mismatch means anything.

Build hands-on intuition for symmetric and asymmetric encryption, and prove at the packet level why HTTPS matters.

OpenSSL, Apache, Wireshark, Kali Linux

• Performed AES-256-CBC symmetric encryption/decryption
• Generated RSA-2048 key pairs and performed asymmetric encryption/decryption
• Stood up Apache with a self-signed cert and compared HTTP vs. HTTPS traffic in Wireshark

Seeing plaintext credentials sitting in a Wireshark capture over HTTP made the case for HTTPS in a way no slide deck ever could.

Build a working, reliable home lab environment as the foundation for every later exercise in this portfolio.

VirtualBox, Kali Linux, Ubuntu

• Installed and configured Kali Linux and Ubuntu VMs
• Set up bridged networking between VMs
• Verified IP assignments using ip a and practiced core Linux networking commands and troubleshooting

Getting the lab environment right upfront instead of fighting networking issues mid-exercise saves far more time than it costs.