Hunting for Living Off The Land Binaries
A methodology for detecting LOLBAS techniques using behavioral analytics and Sigma rules. Covers real-world hunting scenarios.
Defending digital infrastructure through advanced threat detection, incident response, and proactive security operations. Passionate about building resilient defenses and hunting adversaries.
A dedicated cybersecurity professional with a passion for defending digital assets and hunting threats.
I am a SOC L1 Analyst with hands-on experience in security operations, digital forensics, and incident response. My journey in cybersecurity began with a deep curiosity about how systems work and how they can be protected.
Today, I specialize in Blue Team operations, actively monitoring security events, analyzing threats, and developing detection rules to safeguard organizational assets. I am passionate about threat hunting, malware analysis, and building automated security solutions.
Currently interning at a leading security firm, I am expanding my expertise in detection engineering, SIEM optimization, and adversary simulation. I believe in continuous learning and contributing to the security community through open-source projects and knowledge sharing.
Research Interests: Adversary Detection, Automated Threat Intelligence, Cloud Security, Automotive Cybersecurity (CAN Bus Security), and AI-driven Security Analytics.
A comprehensive toolkit built through hands-on experience in security operations and research.
A collection of security tools, research projects, and defensive solutions I've built.
Detailed incident reports with MITRE ATT&CK mapping, tool analysis, and remediation strategies.
Investigation of a Conti ransomware deployment through phishing email, lateral movement via PsExec, and domain-wide encryption. Full timeline reconstruction and IOC extraction.
Analysis of a targeted BEC campaign using domain spoofing and credential harvesting. Tracked email flow, identified compromised accounts, and implemented DMARC/DKIM hardening.
Simulated investigation of a supply chain compromise leveraging SolarWinds-style techniques. Covered initial access, persistence via DLL sideloading, and C2 beaconing detection.
Investigation of unauthorized data exfiltration by a privileged user. Analyzed DLP alerts, proxy logs, and USB device usage to build a comprehensive evidence timeline.
Detection and analysis of PowerShell Empire agent activity on endpoints. Focused on AMSI bypass attempts, reflective DLL injection, and encoded command detection.
Deep dive into Cobalt Strike beacon configuration extraction, Malleable C2 profile analysis, and network traffic decryption to understand attacker TTPs and infrastructure.
Curated detection rules for various security platforms, mapped to MITRE ATT&CK.
title: Suspicious PowerShell Download status: stable description: Detects suspicious PowerShell download commands logsource: product: windows service: powershell detection: selection: CommandLine|contains: - "IEX(New-Object Net.WebClient)" - "downloadstring" - "bitsadmin" condition: selection tags: - attack.execution - attack.t1059.001
title: LSASS Memory Access status: stable description: Detects memory access to LSASS logsource: product: windows service: sysmon detection: selection: EventID: 10 TargetImage|endswith: "lsass.exe" GrantedAccess|contains: - "0x1010" - "0x1410" condition: selection tags: - attack.credential_access - attack.t1003.001
rule CobaltStrike_Beacon { meta: author: "Hamid" description: "Detects Cobalt Strike beacon" date: "2024-01-15" strings: $a = "beacon.dll" nocase $b = "%s as "%s" $c = { 4D 5A } condition: uint16(0) == 0x5A4D and filesize < 5000KB and all of them }
rule Ransomware_Indicators { meta: author: "Hamid" description: "Ransomware file markers" strings: $ext1 = ".locked" $ext2 = ".encrypted" $note = "README_DECRYPT" $btc = /1[a-km-zA-HJ-NP-Z1-9]{25,34}/ condition: any of them }
<group name="authentication_failure,"> <rule id="100100" level="10"> <if_sid>5716</if_sid> <options>alert_by_email</options> <frequency>8</frequency> <timeframe>120</timeframe> <description>Multiple SSH authentication failures</description> <group>authentication_failures,</group> </rule> </group>
<group name="web,accesslog,"> <rule id="100200" level="12"> <decoded_as>web-accesslog</decoded_as> <match>.php|.jsp|.asp|.aspx</match> <regex>POST .*upload</regex> <description>Potential web shell upload detected</description> <group>web_attack,</group> </rule> </group>
<RuleGroup name="" groupRelation="or"> <ProcessAccess onmatch="include"> <TargetImage condition="end with">lsass.exe</TargetImage> <GrantedAccess condition="contains any">0x1010;0x1410;0x143A;0x1430</GrantedAccess> <CallTrace condition="contains">UNKNOWN</CallTrace> </ProcessAccess> </RuleGroup>
<RuleGroup name="" groupRelation="or"> <WmiEvent onmatch="include"> <Operation condition="is">Created</Operation> <EventNamespace condition="is">root\subscription</EventNamespace> </WmiEvent> </RuleGroup>
{ "rule_id": "mimikatz-execution", "name": "Mimikatz Execution Detection", "type": "query", "query": "process.name:mimikatz.exe OR process.args:*sekurlsa*", "threat": [ { "framework": "MITRE ATT&CK", "technique": [{ "id": "T1003.001" }] } ] }
{ "rule_id": "suspicious-scheduled-task", "name": "Suspicious Scheduled Task Creation", "type": "eql", "query": "process where event.type == \"start\" and process.name == \"schtasks.exe\" and process.args : (\"*/create*\", \"*/ru system*\")", "threat": [ { "framework": "MITRE ATT&CK", "technique": [{ "id": "T1053.005" }] } ] }
Standardized response procedures for common security incidents.
Professional certifications and continuous learning achievements.
Articles, write-ups, and research findings from the frontlines of cybersecurity.
A methodology for detecting LOLBAS techniques using behavioral analytics and Sigma rules. Covers real-world hunting scenarios.
Best practices for writing maintainable, high-fidelity Sigma rules with proper logsource definitions and field mappings.
Step-by-step guide to analyzing Windows memory dumps for malware artifacts, network connections, and process injection.
Exploring the attack surface of modern vehicle networks and implementing intrusion detection for automotive systems.
How to build automated response playbooks that reduce MTTR and improve SOC efficiency through orchestration.
Analyzing known APT29 techniques and developing hunting hypotheses to detect their sophisticated tradecraft.
Open to opportunities, collaborations, and security discussions.
Whether you're looking for a dedicated SOC analyst, need help with threat detection, or want to discuss the latest in cybersecurity research, I'd love to hear from you.