Detection engineering
Suspicious Parent–Child Process
A synthetic endpoint process chain I built to practice writing and validating behavior-based detections with Microsoft security tools.
Labs, detections, and writeups
Security work with receipts.
This is where I’m putting the technical work behind the résumé: detection ideas, synthetic incidents, network investigations, lab builds, and the writeups that explain what I tested and what happened.
Network detection
Cross-Zone Lateral Movement
A detection exercise using firewall and endpoint data to identify movement between network security zones.
Incident response
Synthetic Incident Series
A series of fake-but-realistic security incidents I can investigate end to end without waiting for production to catch fire.
STATUS: I’m still turning the raw lab work into readable case studies. Code and writeups will appear here as I finish them.