An end-to-end security monitoring lab using wazuh as our EDR/SIEM for telemetry enrichment and detection engineering & caldera for adversary emulation simulating TTPs. This project demonstrates...

A high-fidelity lab using Security Onion and Caldera for SOC operations and Adversary Emulation & Simulation for a purple team feedback loop enhancing security validation. Executive Summary T...

An alert pings at a Security Operations Center (SOC) and I find a signature hit for ET MALWARE Lumma Stealer Victim Fingerprinting Activity that triggered on traffic from 153[.]92[.]1[.]49 over TCP...

We develop a Windows kernel-mode rootkit to conceal a running implant process by analyzing kernel memory structures via WinDbg, identifying the key _EPROCESS offsets for UniqueProcessId, ActiveProc...

The case study demonstrates how KCB’s vertical integration creates a closed-loop ecosystem controlling payment infrastructure, transaction data, and credit decisioning—enabling instant, data-driven...

Phishing remains one of the most common entry points for threat actors abusing this TTP documented under MITRE ATT&CK framework T1566.001.Targeted spear phishing campaigns mimic trusted interna...

Holo is an Active Directory (AD) and Web Application attack lab that teaches core web attack vectors and advanced or obscure Active Directory attacks along with general red teaming methodology and ...

This room emphasizes enumeration skills where we found a virtual host then exploited path traversal and LFI to get an ssh private key in the config file which got us an initial foothold.Privilege e...

Exploiting a command injection vulnerability in Apache Tika gaining an initial foothold and abusing AlwaysInstallElevated to escalate privileges to Administrator. Initial Enumeration Nmap scan $...

Focused on IPSec/IKE recon and PSK cracking which gave an ssh passphrase that we used to gain initial foothold.A hostname -based sudo bypass enabled us to escalate our privileges to root. Reconn...