Documenting my Cybersecurity Journey

🧪 SOC Phishing Case #003 — Credential Phishing + Possible Account Compromise Overview This investigation analyzes a phishing attack targeting an HR employee through a fake Microsoft password-expiration notification. Unlike a simple phishing attempt where a user clicks a malicious link but does not provide credentials, this case progressed fur... Read More

🧪 SOC Case #005 — Incident Scoping & Patient Zero Overview This investigation focused on a different SOC question: How far did the attack spread? Rather than analyzing one suspicious event in isolation, the objective was to correlate email, endpoint, network, authentication and file-share telemetry across multiple workstations. The ... Read More

SOC Phishing Investigation — Microsoft Account Verification Credential Phishing Analysis and Post-Click Investigation 1. Investigation Overview This case study presents a hypothetical SOC investigation involving a phishing email impersonating Microsoft Security. The exercise was designed to evaluate how a SOC analyst moves from: Suspiciou... Read More

Splunk SOC Investigation — ITSupport02: From Legitimate Administration to Confirmed Compromise Overview This hypothetical SOC investigation examines activity involving ITSupport02 across CLIENT60, CLIENT61, DC01, and FILESERVER02. The exercise is designed around an important SOC challenge: legitimate administrative activity can closely resemb... Read More

Splunk SOC Investigation Case Study: HelpDesk03 — Legitimate Administration or Compromise? Overview This case study documents a hypothetical SOC investigation designed to test the distinction between legitimate IT administration and potentially malicious activity. The investigation follows the activity of HelpDesk03 across CLIENT51, CLIENT50,... Read More

SOC Investigation Case Study: The Missing Beginning Overview This case study simulates a SOC investigation in which the beginning of an attack is not fully visible in the available telemetry. The objective was to investigate a sequence of Windows events involving: FinanceUser02 CLIENT31 CLIENT30 DC01 FILESERVER01 The investigat... Read More

SOC Investigation Case Study — The Compromised Administrator Investigation Objective This exercise simulates a potential compromise involving a privileged IT administrator account and multiple Windows systems. The objective was to determine where legitimate administrative activity transitioned into suspicious behavior, identify the point at ... Read More

SOC Investigation Case Study — The Administrator and the Intruder Mixed-Telemetry Investigation: Distinguishing Legitimate Administration from Active Compromise Overview This investigation was designed to simulate a realistic SOC scenario where legitimate administrative activity transitions into malicious behavior. The challenge was not sim... Read More

SOC Investigation Case Study: The HelpDesk Account Investigating Suspicious Active Directory Enumeration and Remote PowerShell Administration Overview This case study documents a simulated SOC investigation involving a legitimate-looking helpdesk account, HelpDesk01, performing Active Directory enumeration followed by remote PowerShell admi... Read More

SOC Case Study 01 – The Silent Domain Admin Investigating Active Directory Reconnaissance, Lateral Movement, and Suspected Data Exfiltration Overview This case study documents a simulated Security Operations Center (SOC) investigation in which multiple Windows Security Events, Sysmon logs and PowerShell telemetry were correlated to determine ... Read More

Splunk PowerShell Multi-Event Correlation Investigation Investigating PowerShell Web Requests Across Multiple Windows Event Sources Overview This project documents a hands-on SOC investigation focused on correlating PowerShell activity across multiple Windows telemetry sources using Splunk SIEM. The objective of the lab was to simulate sus... Read More

Splunk PowerShell Script Block Logging Lab Detecting PowerShell Abuse Using Windows Event ID 4104 Overview This project documents a hands-on SOC detection lab focused on identifying suspicious PowerShell activity using Windows PowerShell Script Block Logging and Splunk. The objective of the lab was to understand how defenders investigate P... Read More

Splunk Windows Service Persistence Detection Lab Detecting Malicious Service Creation Using Windows Event ID 7045 Overview This project documents a hands-on SOC detection lab focused on identifying malicious Windows service creation using Splunk and Windows Event Logs. The objective of the lab was to understand how attackers abuse Windows ... Read More

Splunk Scheduled Task Persistence Detection Lab Detecting Windows Scheduled Task Persistence Using Event ID 4698 Overview This project documents a hands-on SOC detection lab focused on identifying Windows scheduled task persistence using Splunk and Windows Security logs. The objective of the lab was to understand how attackers abuse schedu... Read More

Splunk Registry Run Key Persistence Detection Lab Detecting Windows Autorun Persistence Using Sysmon Event ID 13 Overview This project documents a hands-on SOC detection lab focused on identifying Windows persistence mechanisms using Sysmon registry monitoring and Splunk. The objective of the lab was to understand how attackers maintain ac... Read More

Splunk PowerShell Network Correlation Lab Detecting Suspicious PowerShell Download Activity Using Sysmon and Splunk Overview This project documents a hands-on SOC detection lab focused on identifying suspicious PowerShell activity and correlating process creation events with outbound network connections using Splunk and Sysmon. The objecti... Read More

Splunk Process Tree Detection Lab — Parent and Child Process Investigation Overview This lab focuses on process creation monitoring and process tree analysis using Splunk and Windows Security Event Logs. The objective of the lab was to understand how parent-child process relationships appear in Windows telemetry and how SOC analysts reconstru... Read More

Beginner SOC Lab with Splunk — Windows Log Analysis and Authentication Monitoring Overview This project documents my hands-on learning journey with Splunk as I practice core Security Operations Center (SOC) workflows in a virtual lab environment. The objective of this lab was to: Install and configure Splunk Enterprise Set up a small vi... Read More

Snort Custom Rule Detection Lab Overview This project demonstrates the creation and testing of custom intrusion detection rules using Snort in a controlled lab environment. The objective was to configure Snort to detect specific types of network traffic and generate alerts when those traffic patterns occur. Two detection scenarios were impleme... Read More

Overview I am excited to share that I successfully passed the CompTIA Security+ certification exam with a score of 782. Security+ is a globally recognized cybersecurity certification that validates foundational knowledge across: Threat detection and response Network security Identity and access management Security architecture Cryptogra... Read More

📡 Telecom Transmission Planning & Aggregation Design Challenge Overview This project documents the solution to a telecommunications transmission planning challenge involving bandwidth calculation, Busy Hour Traffic (BHT) engineering, microwave backhaul dimensioning, redundancy planning, and future capacity growth. The objective was to desi... Read More

Case Overview This investigation analyzes a packet capture file (2023-02-03.pcap) to identify suspicious activity, Indicators of Compromise (IOCs), and evidence of malware infection within a local network. The objective was to examine network traffic, trace malicious downloads, observe post-infection behavior, and determine the overall securit... Read More

📄 Download Full Report (PDF): Malware Traffic Analysis Report 🛡 Case Overview A packet capture file (2021-09-14.pcap) containing 3,679 packets was analyzed following reports that an endpoint device may have downloaded malware. The objective of this analysis was to identify suspicious network activity and extract potential Indicators of Compromi... Read More

🌐 Project Overview This lab demonstrates how HTTP traffic is transmitted in plaintext and can be observed using packet capture tools. The objective was to show why unencrypted protocols like HTTP present security risks, as sensitive data can be exposed during transmission. 📄 Full Technical Report: Download the Plaintext HTTP Traffic Analysis R... Read More

📡 Project Overview This project demonstrates practical network packet capture and TCP traffic analysis performed in a local lab environment using Kali Linux. The objective was to observe how systems communicate over TCP and understand how the three-way handshake establishes reliable connections. The lab involved setting up a local HTTP server ... Read More

Introduction As part of my journey into Security Operations (SOC), I analyzed a suspicious email to identify potential phishing indicators. This post documents the investigation process and key observations from a SOC analyst perspective. Objective The goal of this analysis was to: Review email headers and metadata Identify spoofing or... Read More

I created a GitHub account I forked a repository from https://github.com/datamaunz I renamed the forked repository precious-anyanwu.github.io I edited the files as described in the README.md Now I am writing my first post by following the advice that I got from the README file Read More

Introduction to Python This post is meant to summarize some of the key concepts I have learned in the course Introduction to Python Read More

Resources This is a good guide to learn about the basic markdown syntax. Read More