All Write-ups

010 Articles

Investigations, detection engineering notes, and blue-team CTF walkthroughs focused on documenting the thinking process, not just the answers.

⚠

Under Maintenance

Technical write-ups and lab documentation are currently undergoing maintenance and migration. The articles listed below are actively being synchronized with updated formatting, technical analysis, and verified repository links.

thm-01

SOC Simulation

TryHackMe: Introduction to Phishing

A walkthrough of the SOC Simulator introductory scenario, covering real-time alert monitoring, identifying suspicious emails, and creating detailed case reports.

2026-085 min read min read

thm-02

Incident Response

TryHackMe: Phishing Unfolding

Analyzing a live phishing attack as it unfolds. Documenting critical events including PowerShell executions, reverse shells, and suspicious DNS requests.

2026-088 min read min read

thm-03

Cyber Defence

TryHackMe: Summit

Chasing a simulated adversary up the Pyramid of Pain, focusing on advanced cyber defence frameworks and threat actor methodologies.

2026-087 min read min read

thm-04

Threat Hunting

TryHackMe: Eviction

Unearthing and eradicating persistent threats in a compromised environment using established cyber defence frameworks.

2026-0810 min read min read

wk-01

Detection Engineering

Building an Enterprise Wazuh SIEM Home Lab

A step-by-step walkthrough of deploying a Wazuh manager, connecting virtualized endpoints, and creating custom detection rules.

2026-1012 min read min read

wk-02

Log Analysis

Aggregating Security Logs with Splunk Enterprise

Documenting the setup of a Splunk environment to ingest firewall and Windows event logs, complete with custom SPL queries for threat hunting.

2026-0910 min read min read

wk-03

Threat Hunting

Scalable Threat Hunting with the ELK Stack

How I designed a high-volume Elastic Stack (Logstash, Elasticsearch, Kibana) to process security telemetry and surface C2 beaconing anomalies.

2026-0815 min read min read

wk-04

System Security

Securing Linux Servers: A CIS Benchmark Playbook

A deep dive into creating a comprehensive Bash hardening script based on CIS benchmarks, including AppArmor and IPtables configuration.

2026-078 min read min read

wk-05

Offensive Security

Automating External Attack Surface Reconnaissance

Building a custom Python/Bash pipeline to chain Nmap, Sublist3r, and Gobuster, drastically reducing the time spent on initial penetration testing phases.

2026-0611 min read min read

wk-06

Vulnerability Management

Engineering a Centralized Vulnerability Management Dashboard

Integrating scan results from multiple security tools into a single pane of glass to prioritize remediation efforts based on CVSS and business impact.

2026-059 min read min read