I specialize in investigating security incidents, performing threat hunting, and building detection logic from real telemetry in homelab environments. My goal is to translate raw logs into actionable security insights and strengthen defensive operations.
- PowerShell Execution Investigation: Analyzed Windows Event Logs & Sysmon to detect suspicious encoded PowerShell usage
- Brute Force & Authentication Anomalies: Investigated repeated login failures and lateral movement attempts
- Structured Reporting: Each investigation includes hypothesis, evidence, analysis, and conclusion
- Brute Force Detection (Event ID 4625) – SPL/KQL queries with thresholds and false positive considerations
- Suspicious PowerShell Execution Detection – Event monitoring with logic and limitation notes
- Approach: Hypothesis-driven, log-based, detection-focused
- Simulate real-world attack scenarios
- Collect and analyze logs from multiple systems
- Test and refine detection rules for accuracy and efficiency
While my focus is security, I leverage backend experience to support automation and analysis:
- Languages: Python, Java
- Frameworks: FastAPI, Django
- Databases: PostgreSQL, MySQL
- Tools: Docker, Postman
Applied Python for log parsing and detection rule prototyping.
- Expanding detection logic depth and coverage
- Improving threat hunting methodology
- Strengthening understanding of attacker techniques & MITRE ATT&CK mapping
- LinkedIn: Ilyes HAMDI