Pinned Loading

1. malware-traffic-analysis-trickbot malware-traffic-analysis-trickbot Public

   Network forensics lab, full TrickBot infection traced from a PCAP using Wireshark, VirusTotal, and a custom Suricata detection rule.

2. azure-ad-attack-detection-lab azure-ad-attack-detection-lab Public

   zure-based Active Directory attack detection lab — Kerberoasting, AS-REP Roasting, DCSync, and Pass-the-Hash detected in Microsoft Sentinel with KQL

3. sentinel-ssh-brute-force-lab sentinel-ssh-brute-force-lab Public

   Microsoft Sentinel lab detecting live SSH brute force attacks using KQL analytics rules mapped to MITRE T1110. Built on Azure VM with real attacker traffic.

4. wireshark-ssh-bruteforce-analysis wireshark-ssh-bruteforce-analysis Public

   Network-layer analysis of live SSH brute force traffic captured on an Azure VM — packet forensics, tool fingerprinting, and correlation with Microsoft Sentinel logs.

   HTML

5. Elastic-eql-lab Elastic-eql-lab Public

   Self-managed Elastic Stack build with ECS-mapped auth log ingestion and EQL sequence correlation. Personal lab.

6. xdr-lab-elastic-defend-correlation xdr-lab-elastic-defend-correlation Public

   XDR-style lab correlating SSH auth events with Elastic Defend endpoint telemetry via EQL, detecting brute-force login followed by recon commands