Project Archive
All Projects
A growing archive of IT operations, systems administration, cybersecurity operations, DFIR, Active Directory security, network analysis, and portfolio development work.
Completed
PHANTOM CTI CTF: Supply Chain Investigation
Investigated a simulated npm supply-chain compromise affecting a GitHub Actions self-hosted runner, including IOC extraction, MITRE mapping, threat hunting, and detection logic.
PHANTOM CTI CTF: Supply Chain Investigation
Investigated a simulated npm supply-chain compromise affecting a GitHub Actions self-hosted runner, including IOC extraction, MITRE mapping, threat hunting, and detection logic.
Built an evidence-based investigation narrative from package-lock changes, CI/CD logs, proxy evidence, GitHub audit activity, malware behavior, indicators of compromise, and remediation priorities.
Completed
ENVELOPE DFIR: Malware & Incident Response
Documented a phishing-led Windows compromise involving PowerShell, persistence, DLL side-loading, live C2 interaction, credential material, and detection engineering.
ENVELOPE DFIR: Malware & Incident Response
Documented a phishing-led Windows compromise involving PowerShell, persistence, DLL side-loading, live C2 interaction, credential material, and detection engineering.
Reviewed Windows artifacts, decoded payload behavior, mapped persistence mechanisms, identified high-fidelity detection signals, and produced remediation recommendations for a lab incident scenario.
Completed
Build a SOC Lab with Wazuh | AI-Assisted SOC Triage
Built a Wazuh SOC lab with Windows/Linux telemetry, FIM, custom rules, dashboards, Active Response, and a local AI-assisted triage extension using Ollama, Qwen, Python policy logic, and human validation.
Build a SOC Lab with Wazuh | AI-Assisted SOC Triage
Built a Wazuh SOC lab with Windows/Linux telemetry, FIM, custom rules, dashboards, Active Response, and a local AI-assisted triage extension using Ollama, Qwen, Python policy logic, and human validation.
Extended a traditional SIEM monitoring lab into a hybrid SOC workflow where Wazuh detects, Python enforces known facts, AI explains and recommends, and the human analyst remains the final decision authority.
Completed
AI Phishing Email Analyzer
Built a transparent phishing-analysis application with Python, Streamlit, optional local Ollama and Qwen explanations, guardrails, JSON reporting, and 13 automated tests.
AI Phishing Email Analyzer
Built a transparent phishing-analysis application with Python, Streamlit, optional local Ollama and Qwen explanations, guardrails, JSON reporting, and 13 automated tests.
Detection Engine v2 corrected three false negatives through expanded social-engineering rules, multiline header parsing, sender-domain extraction, and brand-domain validation while Python retained control of the evidence, score, and classification.
Completed
Ubuntu Application Server Secure Baseline & Recovery
Hardened an Ubuntu 24.04 application server in a VMware lab, including package repository repair, GRUB recovery, UFW firewall restriction, OpenSSH hardening, Netplan correction, and recovery snapshots.
Ubuntu Application Server Secure Baseline & Recovery
Hardened an Ubuntu 24.04 application server in a VMware lab, including package repository repair, GRUB recovery, UFW firewall restriction, OpenSSH hardening, Netplan correction, and recovery snapshots.
Documented a repeatable Linux infrastructure-security baseline for wcds-app-01, validated DNS, routing, TLS reachability, package health, SSH service status, firewall scope, and zero failed systemd units.
Completed
Cyber Defense Technician Practical Path
Summarized a hands-on Level Effect path covering Windows, Linux, networking, Active Directory, helpdesk ticket handling, evidence review, and the CDT scenario-based exam.
Cyber Defense Technician Practical Path
Summarized a hands-on Level Effect path covering Windows, Linux, networking, Active Directory, helpdesk ticket handling, evidence review, and the CDT scenario-based exam.
This path connects IT operations fundamentals to the SOC Analyst Path by building practical Windows, Linux, network, Active Directory, troubleshooting, and evidence-based decision-making skills.
Completed
Windows Enterprise Administration & Active Directory Security Lab
Consolidated Windows Server and Active Directory lab covering AD DS, DNS/DHCP, Group Policy, forest trusts, delegated administration, file services recovery, PowerShell, and security validation.
Windows Enterprise Administration & Active Directory Security Lab
Consolidated Windows Server and Active Directory lab covering AD DS, DNS/DHCP, Group Policy, forest trusts, delegated administration, file services recovery, PowerShell, and security validation.
Documented end-to-end administration, troubleshooting, remediation, and validation across a controlled enterprise-style lab, including TT.WI.LOCAL, BB.WI.LOCAL, and a separate GOODCORP least-privilege delegation challenge.
Completed
SOC Triage: Suspicious Download
Reviewed suspicious double-extension activity, documented host/user details, assessed execution risk, and listed persistence and network checks.
SOC Triage: Suspicious Download
Reviewed suspicious double-extension activity, documented host/user details, assessed execution risk, and listed persistence and network checks.
Mapped alert context into a clean triage workflow: identify the suspicious file, validate the host and user context, assess risk, document evidence, and define next checks.
Completed
Network Traffic Analysis
Used Wireshark filters and protocol review to investigate DNS, HTTP, ICMP, user-agent strings, and peer-to-peer activity in PCAP exercises.
Network Traffic Analysis
Used Wireshark filters and protocol review to investigate DNS, HTTP, ICMP, user-agent strings, and peer-to-peer activity in PCAP exercises.
Practiced interpreting traffic at the packet level and distinguishing normal network behavior from items that require closer inspection or analyst review.
Completed
Security Monitoring & Vulnerability Management Lab
Practiced centralized logging, alert review, endpoint hardening, reporting, and attack surface reduction with Splunk/Security Onion concepts.
Security Monitoring & Vulnerability Management Lab
Practiced centralized logging, alert review, endpoint hardening, reporting, and attack surface reduction with Splunk/Security Onion concepts.
Connected monitoring, vulnerability awareness, patching concepts, hardening, and documentation into a practical defensive operations workflow.
In Progress
IT/OT Segmentation Lab
Planned separation of IT, OT, and DMZ networks with firewall rules, OpenPLC/Modbus simulation, and monitoring between segmented networks.
IT/OT Segmentation Lab
Planned separation of IT, OT, and DMZ networks with firewall rules, OpenPLC/Modbus simulation, and monitoring between segmented networks.
This in-progress lab is intended to show network segmentation, firewall policy, OT protocol awareness, and monitoring controls across simulated enterprise and industrial zones.
Completed
Cybersecurity Portfolio Rebuild
Rebuilt an early front-end portfolio into a focused IT and cybersecurity portfolio with case studies, responsive layout, project archive, theme toggle, and animated UI elements.
Cybersecurity Portfolio Rebuild
Rebuilt an early front-end portfolio into a focused IT and cybersecurity portfolio with case studies, responsive layout, project archive, theme toggle, and animated UI elements.
Turned the portfolio itself into a documented project covering content strategy, responsive front-end design, accessibility, dark/light mode, collapsible project cards, and public-safe presentation.