Projects
Two investigations first. One rebuilds an intrusion from the evidence it left behind, the other takes malware apart in an isolated lab. Everything else follows underneath.
Kill chain reconstruction
My capstone investigation: a simulated ransomware attack on a municipal network, reconstructed from six disk images, seven memory captures, 12.7M packets, and more than 90,000 log entries. Each stage covers one part of the attack and the evidence that established it.
Malware lab
Twelve public malware samples analyzed in an isolated FlareVM environment. Each sample followed the same workflow: verify the PE header, hash it, check against VirusTotal, identify the family, test for packing and obfuscation, pull strings, then detonate and observe behavior. Static triage used HxD, HashMyFiles, Exe Info PE, and PeStudio; dynamic analysis used Process Monitor, Regshot, System Informer, Wireshark, and FakeNet-NG to simulate the network for C2. Pick a sample to see its full triage record.
The archive
Networking labs, response playbooks, risk analysis, and code. Click a record to open it.