I’m curious about cybersecurity and love getting hands-on with real challenges. Working on projects like reverse-engineering USB drop attacks and digging into Dropbox data leaks in Azure lets me experiment, analyze, and tell the story behind the logs. Right now, I’m diving deeper into cloud security on Azure—learning how to spot threats using logs, endpoint tools, and security analytics.

Self-directed investigations inspired by real-world TTPs

• 💥 Malware Analysis - PwnCrypt
  Simulated a PowerShell-based ransomware attack to study encryption behavior and impact.
  Analyzed file changes, encoded payloads, ransom notes, and mapped MITRE ATT&CK stages.

• 🎯 CTF Postmortem: Lurker
  Red team-style scenario analysis. Mapped attacker behavior through logs.
  Postmortem format with IOC timeline and lessons learned.

• 💾 USB Malware Execution via PowerShell
  Identified malicious script execution triggered by a rogue USB drop scenario.
  Used MDE (DeviceProcessEvents), KQL, and Sentinel to trace PowerShell payload.

• 🔍 Dropbox Exfiltration – Insider Threat
  Investigated potential insider data theft using personal Dropbox.
  Used MDE, DeviceProcessEvents, KQL, and Sentinel dashboards.

• 🌐 Tor Browser Usage Detection
  Detected unauthorized Tor traffic and file execution using EDR logs.
  Mapped to MITRE ATT&CK (T1102), built visual attack paths.

• 🦊 Unauthorized Firefox Installation
  Hunt for unapproved browser install/use in an enterprise environment.
  Leveraged DeviceFileEvents, MDE alerts, PowerShell traces.

Hands-on experience with real tools and cloud-native environments

• 🧠 Threat Hunting Lab Reports
  Sentinel & Defender labs using KQL, NSG flow logs, MDE, and LAW.

• 🚨 Incident Response Lab Reports
  Root cause analysis and isolation workflows in Microsoft Defender for Endpoint.

• 💡 Threat Hunt Ideas
  Ongoing ideas for future hunts: DNS tunneling, malicious USBs, more.

Feel free to connect if you're working on a security project, hiring, or just want to chat about threat hunting and cloud defense.