Skip to content

Projects

Security case studies with GitHub evidence

Lab and cyber-range work in vulnerability management, secure configuration, PowerShell automation, and threat investigation. Each case study links its findings to source evidence.

Project review path

Start with the outcome, then drill into evidence.

Review the environment, problem, and findings, then follow the scan reports, scripts, queries, and screenshots in the full technical write-up. Role alignment describes the skills practiced in each project.

01

Cyber-range investigation

Password Spray Threat Hunt: RDP Compromise Investigation

Role alignment: SecOps Analyst / SOC Analyst / Threat Detection Analyst

Cyber-range investigation using Microsoft Defender for Endpoint and KQL to trace RDP access, execution, persistence, defense evasion, command-and-control activity, and attempted exfiltration.

Read case studyView GitHub

Skills demonstrated

The RDP compromise investigation shows the ability to pivot across endpoint telemetry, explain what the evidence supports, and separate confirmed activity from unsupported assumptions.

Problem

Suspicious RDP access in a cyber range required investigation across endpoint telemetry.

Outcome

The report reconstructs the attack path and attempted exfiltration.

Concepts

RDP logon analysis, KQL pivots, ATT&CK mapping, and exfiltration evidence review.

Tools

MDE Advanced HuntingMicrosoft SentinelMicrosoft Defender for EndpointSIEMKQLMITRE ATT&CK
02

Cyber-range investigation

The Buyer / Akira Ransomware Threat Hunt

Role alignment: Threat Hunter / SecOps Analyst

Cyber-range Akira ransomware hunt using Microsoft Defender telemetry to reconstruct remote access, staging, lateral movement, defense evasion, data staging, and impact artifacts.

Read case studyView GitHub

Skills demonstrated

The ransomware hunt demonstrates the ability to reconstruct ransomware activity from telemetry, preserve a defensible timeline, and turn observed behavior into detection opportunities.

Problem

A cyber-range ransomware scenario required host scoping, timeline analysis, and detection-gap review.

Outcome

Two affected lab hosts, investigation findings, and detection recommendations are documented.

Concepts

Ransomware timeline, remote access triage, tampering, and impact.

Tools

MDE Advanced HuntingMicrosoft SentinelMicrosoft Defender for EndpointSIEMKQLMITRE ATT&CK
03

Lab project

Vulnerability Management Program Implementation

Role alignment: Vulnerability Management Analyst

Windows Server lab covering authenticated Tenable scanning, prioritized remediation, and verification, alongside simulated policy and stakeholder coordination.

Read case studyView GitHub

Skills demonstrated

The vulnerability management project shows the ability to turn scan output into prioritized remediation, communicate risk clearly, and validate that fixes reduced exposure.

Problem

A simulated organization needed a scanning, prioritization, and verification process.

Outcome

Lab findings fell from 32 to 4 across seven scans; critical findings fell from 2 to 0.

Concepts

Governance, authenticated scanning, risk prioritization, and validation.

Tools

TenableAzure Cloud InfrastructureAzure Virtual MachinesPowerShellWindows Server
04

Lab project

DISA STIG Remediation Project

Role alignment: Security Analyst / Technical Compliance Analyst

PowerShell remediation scripts with screenshot validation for selected Windows 11 DISA STIG findings in a lab environment.

Read case studyView GitHub

Skills demonstrated

The STIG remediation work shows practical secure-configuration judgment: interpreting control requirements, translating them into repeatable PowerShell changes, and preserving validation evidence without overstating compliance.

Problem

Windows 11 STIG findings needed scripted fixes and validation proof.

Outcome

Selected controls are documented without claiming full compliance.

Concepts

Registry policy, audit policy, PowerShell checks, and evidence capture.

Tools

PowerShellDISA STIGCustom DISA STIG GPTWindows 11Windows Registryauditpolgpupdate