writeups/
- tool
AtlaSoc ToolBox: threat-intel lookup toolkit
A threat-intelligence toolkit built to speed up triage: automated IOC extraction, reputation lookups, payload de-obfuscation, and timestamp parsing in one interface.
- cve
CertiGhost (CVE-2026-54121) - Detection Engineering Writeup
Simulated the CertiGhost attack chain in a lab Active Directory environment, then built a Splunk detection anchored on the exact certificate lifecycle events it leaves behind.
- cve
DirtyFrag: Linux kernel privilege escalation via Dirty Page cache
Lab detection exercise for DirtyFrag (CVE-2026-43284): Linux kernel privilege escalation via xfrm-ESP page cache corruption, with detection steps and retest notes.
- ctf
Placing 7th of 192 in a DFIR CTF
42 flags across the full kill chain, KQL threat hunting in Microsoft Defender, and reconstructing attack timelines from correlated endpoint and event log artifacts.
- lab
Azure SOC lab: Sentinel, Defender, and an Auth Abuse Hunting workbook
A cloud SOC lab built to investigate simulated malware execution, C2 beaconing, and data exfiltration in Sentinel and Defender, with custom KQL analytics.
- lab
Enterprise SOC lab: Proxmox, pfSense, and ELK with Suricata
A self-hosted enterprise SOC built on Proxmox, with Active Directory, VLAN-segmented pfSense, and an ELK stack fed by Suricata for live PCAP inspection.
- notes
Security operations notes and incident-response exercises
Practical security operations notes, incident-response exercises, and labs focused on detection, escalation, and decisive response.