Work

ProblemTraining history can look scattered when rooms, badges, and projects live in different places.

CheckedPublic profile, completed-room count, rank, badges, and visible SOC/SIEM/EDR/phishing/Wireshark rooms.

NoiseOffensive rooms are useful context, but this portfolio emphasizes defensive analyst readiness.

Next actionUse the profile as supporting context for hands-on SOC, SIEM, packet analysis, and blue-team practice.

LimitTryHackMe is lab work; production experience is represented separately through healthcare IT, IAM, endpoint support, and documented projects.

ProblemCloud identity alerts can be hard to review when events, principals, and access paths are separated.

CheckedCloudTrail IAM events, nested access relationships, mapped techniques, affected resources, and review context.

NoiseAdmin activity and automation can look risky without ownership and intent.

Next actionGroup the event context into a readable identity-risk path before analyst review.

LimitThe project is a review and detection engineering aid, not a live cloud enforcement system.

ProblemDirectory leftovers create access risk and operational noise.

CheckedDormant users, old computers, disabled accounts, group memberships, and password-age signals.

NoiseService accounts and ownerless groups often need human confirmation.

Next actionReport cleanup candidates, remove risky leftovers, and disable only through review.

LimitFindings need ownership context before removal.

ProblemScheduled automation can become stale, over-privileged, or persistence-like.

CheckedTask names, run paths, schedules, privilege context, and last-run signals.

NoiseLegitimate updaters and maintenance jobs can look suspicious without context.

Next actionKeep, allowlist, investigate, or remove through the operating system outside the tool.

LimitThe project is read-only and does not remove tasks.

ProblemBrowser extensions can quietly expand endpoint exposure.

CheckedPermissions, host access, content scripts, update URL, manifest details, and age.

NoiseSome broad permissions are normal for password managers, blockers, or enterprise tools.

Next actionApprove, investigate, or remove through the browser outside the tool.

LimitThe auditor reviews local metadata; it does not prove extension intent.

ProblemAI assistants inside learning platforms can inherit more authority, context, and trust than users realize.

CheckedExternal tool behavior, user-editable instructions, safety configuration, injected user context, retrieval scope, memory behavior, messaging authority, and evidence handling.

NoiseAI/LMS risk is rarely one single bug; it is often the combination of tools, context, defaults, and unclear boundaries.

Next actionRestrict tool scopes, require visible approval for external actions, minimize LMS context, enforce document ownership, add logging, and regression-test known failure modes.

LimitThe public case study intentionally withholds the confidential report, target identifiers, exploit prompts, screenshots, student data, internal endpoints, and reproduction steps.

ProblemFilter-only KQL custom rules were failing during Detection-as-Code export when the query string was empty.

CheckedKibana filters, empty KQL query behavior, export-rules CLI flow, custom-rule export mode, schema tests, and compile checks.

NoiseEmpty KQL should not be broadly allowed; the fix stays scoped to custom rules with Kibana filters present.

Next actionAllow the export path for valid filter-only custom rules while preserving invalid-case coverage.

LimitThe current replacement PR remains open while maintainers complete review.

ProblemA false-positive filter was not applied consistently across eventlog-clear detection branches.

CheckedSigma rule condition precedence, grouped detection branches, filter scope, comment typo, and sigma check validation.

NoiseEvent log clearing can be suspicious, but installer and administrative activity can create expected noise.

Next actionGroup the suspicious branches before applying the known false-positive filter.

LimitThe PR remains open while upstream review is pending.

ProblemIndirect prompt injection tests need clear payload hints that model realistic source and context confusion paths.

CheckedLLMForge payload wording, localization keys, indirect prompt injection variants, source instruction override, hidden comments, and multi-source context confusion.

NoisePayload wording needs to be effective without becoming ambiguous or too brittle for the test gateway.

Next actionIterate with the maintainer on wording and obfuscated variants until the payload hints fit the project.

LimitThe replacement PR remains open while final maintainer review and merge are pending.

ProblemDetection content loses trust when a process name typo prevents the intended behavior from matching.

CheckedExpected regsvr32.exe string, absence of the typo, YAML parsing, and scoped metadata update.

NoiseThe goal was not to rewrite detection logic, only to correct the broken executable reference.

Next actionSubmit a minimal upstream fix that maintainers could review quickly.

LimitThe public card links to the merged upstream PR and avoids overstating impact beyond the scoped typo fix.

ProblemSOC work depends on understanding normal network behavior before calling something suspicious.

CheckedTraffic flow, addressing, wireless security, remote access, access control, DNS, server logs, and endpoint behavior.

NoiseTraining labs simplify production networks, so the value is in reasoning and documentation rather than claiming enterprise ownership.

Next actionUse the labs to reinforce network, endpoint, and analyst fundamentals while continuing to build public writeups.

LimitCourse files and personal lab answers are kept private; the public portfolio summarizes the skills demonstrated.